Extracted

• • Target

    JaffaCakes118_11ea0654f8bc0683c44d601949b083b9

  • Size

    1.2MB

  • MD5

    11ea0654f8bc0683c44d601949b083b9

  • SHA1

    cecb752d9c769fa764bc7c9862fdf89f21604665

  • SHA256

    7b30f8d1edc149c8e5f698bfcb430b0069aed494b3ac3c66ebbceff73900ca4b

  • SHA512

    1e265cbf0e67e29dcf31204c0c93435b374e1160c10ee57c801a2c6cfe6b3c7ce901b24f7f5e955ec34d4bf557cfe2810dda9ead983abb6b1dd35345344a6bae

  • SSDEEP

    24576:8k4/YSvT4v7Cr2BOCb2h+llAu+/u1d5JmZVvmZV:8kQYS42rIObh+l0qgZVuZV

  Score

  10^/10

  xtremeratdefense_evasiondiscoverypersistenceratspywarethemida

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2