Extracted

• • Target

    JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f

  • Size

    1.0MB

  • MD5

    625f1ab0811df7656488d52c0fe6df7f

  • SHA1

    efe2d912e509cca41c244345786c01d5a98cf136

  • SHA256

    332996f178bab2733717a5a46632f4622d0df1519dd782e532bf47ccfe95aac4

  • SHA512

    a64e335051683b080552c82b137f87819c64125cb97b61f3b007d36c0d45af4633b0f366a589f758c925f3ead19bd7516bb4847005d9f0ba602f07c601e26db3

  • SSDEEP

    24576:2520OwmxOKXJHtkjaYvZJiffU8AazZDd+w1TuED:420jKJkaqZJJ8Aazxd+Uq

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2