Extracted

• • Target

    JaffaCakes118_b9680879e6419bd4793c8b55adcd660c

  • Size

    852KB

  • MD5

    b9680879e6419bd4793c8b55adcd660c

  • SHA1

    5c6f87fdf4f456aabab345d80d2eb4f220310e39

  • SHA256

    aaed356473987345e6cd12d10853ef6164b1d33a82d7cc56fdf51e1afe8e3388

  • SHA512

    a9dc90cfb715fd9f29babc00b63f2303aa916c65443d2d958f5fc2a7002b9c4b6f63f5295cc5cf66a1b16ad0c33e8aa7b3a07a9e4687cfcdb9f8dadaa9479452

  • SSDEEP

    6144:Xaxi4g/Lp2xNswnIgK54IQzeeeL4/Qn6nIgK54IQzeeeL4/:KxNoLp2xN3IgKKM4Yn6IgKKM4

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2