Extracted

• • Target

    JaffaCakes118_9e161e004aedda435eb43ed8b760ff86

  • Size

    59KB

  • MD5

    9e161e004aedda435eb43ed8b760ff86

  • SHA1

    0a26074c7d8893390b027c1514eff6070d8f0bab

  • SHA256

    87878d1ba77fee78212915f8ee900459da05179e002af962c9a3625016fd8163

  • SHA512

    3f98dff58a2ae4f6df8d6e6ee9d3ff1283c977dd3e548c0069db0324a514330bd7a5d4f04f2770d73b7ef20e8c4084032d99f1906df15fe1364db0c5d72ed8f4

  • SSDEEP

    1536:LBNGbeNdZr4Z135Wt0+Ed50Io5AZl5jjOOB1XDRD:Lfla5Wt0+ET0Iogl5jiIXDRD

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2