Extracted

• • Target

    JaffaCakes118_9a3340269d02cfecbc51be6b00020449

  • Size

    99KB

  • MD5

    9a3340269d02cfecbc51be6b00020449

  • SHA1

    ba8d7fa441700c54f1bf388361ec1cb514e18bab

  • SHA256

    7535a2cf66f83dec3b8053ea1855022fced107de179663f53349d6a753a9f18a

  • SHA512

    150500d54006316ef8eeb35eaa6d786d79a2f6e2d1b2d6fd06ec56ab855b93e1480fd7315e6219394a091fde29f398b8862cd5b3f95cd6da1f38f54c844da975

  • SSDEEP

    1536:/3/qIZrPKxmzH4+y50L7Y1XLedhoh8SHtNH+A2wF4aRIjjqwtblrgOSQ+Y:3qL+q0L7YdLOhPSNN7S5blUW

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2