Extracted

• • Target

    JaffaCakes118_f0a6901ad87a4a749755d5f77941a8d2

  • Size

    434KB

  • MD5

    f0a6901ad87a4a749755d5f77941a8d2

  • SHA1

    12ba6faee244bfb0e13f90db099006976eeeb775

  • SHA256

    0025d2cfd176a329463e1fc7e95dccf9968ceb15ce182f5f4c737c121a100a20

  • SHA512

    0db89c497d77c27976867939617b0eadb69e595495fa8b35ddaf45adefef25194bea70817897d205a56caa54f4bca49d26c306818e23ce3a3c4e1bd28d24906b

  • SSDEEP

    6144:+1uhZU6qBAf0olQ85EQPUcAcXnIgK54IQzeeeL4/J:+1uQpGfhllW2pIgKKM4x

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2