Extracted

• • Target

    JaffaCakes118_170320a37ff1e869777b2cf6474c6e08

  • Size

    79KB

  • MD5

    170320a37ff1e869777b2cf6474c6e08

  • SHA1

    b8612e2e0314a034d08f4b38b55c213ff9209d7c

  • SHA256

    68f21aca4c1cc217c49e20b1e42a8d5101e2b48737bcd9229ea4e25539724de8

  • SHA512

    f5ab1de672f8dbfcfddc646b7c338c2b561558444dc878ad8fe4125be99ff244596e93d733ad2d38681875b3583d11912055a9ca486d94fc8718b931de1d7934

  • SSDEEP

    1536:5NGcqZYlSLhe5GDe6JU85n5p+bvVnFEDGPF1HEz6lLYpyqP1uuKrypk0vJ+O:LbuYlS1e5IlJ55TAVnaDGPJRqP1i4rf

  Score

  10^/10

  xtremerataspackv2discoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2