Extracted

• • Target

    JaffaCakes118_5a214df6ff98abe072c84a54fd6b6a2e

  • Size

    167KB

  • MD5

    5a214df6ff98abe072c84a54fd6b6a2e

  • SHA1

    f32e7b4a432ff09a1ffb1dc85194425e48092720

  • SHA256

    31166c12bf45a1fd90c19b0ffd75dccefc921ba3adf1db3377687c7cf594f9a0

  • SHA512

    5af3ed2ff761504a2623d4e948c6b1d5d0b71cb05ae754056b1bc8a17c472a5691474000142599a211c0ce7693f9595d966855f885f975ab2e417c02e611107f

  • SSDEEP

    3072:7/QVZG2YfLc0YfDsj6/uxGE5H3Ibm9sPpCIAIF86/WJhoPT1czphNt:7Bw0YAG/OG4JsxQIFFeDoL2zph

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2