Extracted

• • Target

    JaffaCakes118_5f196fc3bd4b0e264c3eac02488f7ff2

  • Size

    121KB

  • MD5

    5f196fc3bd4b0e264c3eac02488f7ff2

  • SHA1

    a3e8d91b30bb66d6d7fecf859ae1f74f7c669614

  • SHA256

    673f296dabec3508ab4fceb56ddeebf60de0a64b036cb4148cbf0186252329df

  • SHA512

    c4b728b6156ed2cb15b2ef91f00256ba35db3c03e711980e4d94e861062dc7ebd193d5455955b2f0402ff572020b8673cd403e6b8e0629ecc5a0b9f41f44b817

  • SSDEEP

    3072:7nZvNCi3axsajFVfHfffff3HhffffffffDfz:MLN

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2