Extracted

• • Target

    JaffaCakes118_058f7663eb1a83cb01c2cb8ea93a7a93

  • Size

    599KB

  • MD5

    058f7663eb1a83cb01c2cb8ea93a7a93

  • SHA1

    71d83172d4e8a3727c00cfa803f2bc6a51eb6e36

  • SHA256

    9f809ffcbdbe9e312480dccac2999d2fbf20af5b757042e971386cef038dce54

  • SHA512

    0605320d8a9263e48c4db73145a8836752901f916c6e8c72f6c5ec95ec89fa2c5ffaa6da8658c340ca97d018cbb0b04cbaed8534e7212ecace613dda2bc4be5c

  • SSDEEP

    12288:OF7mnlL5nv5IKEV7FaI1Z4+VGLwlrd7BTscSA2RLVnhO4rghXt2GFc58V:o7mnXvKHh5f7iaBNscZuLVy3l88

  Score

  10^/10

  xtremeratdefense_evasiondiscoverypersistenceratspywarethemida

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2