Extracted

• • Target

    JaffaCakes118_0303298d95bb883fbebe3f2eca899cc3

  • Size

    126KB

  • MD5

    0303298d95bb883fbebe3f2eca899cc3

  • SHA1

    a8767bfc15f4669b524f3f5e48fc3e528189332c

  • SHA256

    da2bade5f06af31f40e10667d46ac85dcff3dcefff00667ea681d47a21edc4a4

  • SHA512

    73ee205ae1458afb993293fa5df5206a7e28cb9a30d624f5bbad465f8588c8881f2a9771bcd40bb3563290fcbf760c24b61582e650b54e3c0d8f546668124df3

  • SSDEEP

    1536:lHfA6wKBZbryh0Vttv+7MZ8cyu90AjZN:7I4tvKRAjn

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2