Extracted

• • Target

    JaffaCakes118_a88fb51131740aac70b90e52f26c4c2c

  • Size

    264KB

  • MD5

    a88fb51131740aac70b90e52f26c4c2c

  • SHA1

    7bbcbcd4563a6dbae3b1ff07a350820ddc51c1a1

  • SHA256

    589bfae7dedc5b6e68ae7ad9dca32dbb6add6daa244adee13fe081fd39ab928c

  • SHA512

    241bba695b77770ce50b12b312ee5836a6448b282ccbb30c7c5b5ca0b818d56f1c3eb251fb090c868c9cc29c32b616f7500d1595466db82e6adbfb39c7260448

  • SSDEEP

    1536:SDWY2LVp5mH+V77dC/nLpMbt41HP4nLNTBjO/4jExtKeJr5Fwn:TY2xis7dC/LpKOGxkwYSsron

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2