Extracted

• • Target

    JaffaCakes118_218f9ec64968e5b8b316abe6287c4887

  • Size

    558KB

  • MD5

    218f9ec64968e5b8b316abe6287c4887

  • SHA1

    a35cca916f795183c43b7cc472dbb51d7fd41b84

  • SHA256

    b3c7cb9e4244af48b38034b3ad4cf96dcc61f1433e7708f4011e549ea425d96e

  • SHA512

    005c40a60b4802e041ac9431ef15758eb88d01a5e1d91c9d0cdc1c4f156a51692385b230a54612706846f6d337fd78520ad5da18a3e8fe9098f9c5fdcf53c501

  • SSDEEP

    12288:bcgL1j74QBb1pA0BH7whmh9roBX7SX//1ZGdXddP7SRP:Nx9BvA0BHroBX7SX//1ZGuR

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2