Extracted

• • Target

    JaffaCakes118_e49fa59b2facb42650cf29c60d653990

  • Size

    1.4MB

  • MD5

    e49fa59b2facb42650cf29c60d653990

  • SHA1

    4d1bfbae0b3c5047c40be4fed63a4218bbf480d6

  • SHA256

    e25d2f5f09c95ea6c0dd5e5db8be55dac4bf913f87e4ac1ab8ce863027432ce1

  • SHA512

    b7ddeea87fdc218d8c1765be9b34c9399f120d6f6df46b39af887c25cbde894a17952156282d08aabaa842094ddc7f0aeee91f2bf4e6632a89ad2e85a7b5b62b

  • SSDEEP

    24576:7xRRtXc2uqRePccDXfZak5hSg0f6AsEwmHfy5yWgjT3NvIrf1ajRumgTaI2:rz6uaDRN5hSg0f6AxwmHf2gjT3Bi1ajh

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2