Extracted

• • Target

    JaffaCakes118_f7e7c262b546b461a81763bc3831d0d9

  • Size

    805KB

  • MD5

    f7e7c262b546b461a81763bc3831d0d9

  • SHA1

    73456616c3f3c659ef7111666ffcb522390f4804

  • SHA256

    87bb4d108c420873c15e7d87d22182b2764f7a9be78cf40d2ab9af8e59645f62

  • SHA512

    9142974838ece6c105923387133c31ea75ddebe7efe8a01e281e67626ea2e43523f744020887412cf030798c98a563e41d86c54d5aab965aed43daeaf4ce4777

  • SSDEEP

    12288:z8FNK/GdSDaqFmadIg4KaoSLBBjjP0MccUXUs2HFs7sIgn585n7i:YFvca8wg4XHPzccAN2HFsoIgiG

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2