Extracted

• • Target

    JaffaCakes118_fcee730be8140f2aee61745c9a38127d

  • Size

    852KB

  • MD5

    fcee730be8140f2aee61745c9a38127d

  • SHA1

    ca64c73a5828e4492e8c6dd0e747b64e51e30b5c

  • SHA256

    293bde3fdfa0643b40d9bd82eccd42e2e30225aec267c2a4e0a5ca8236da6d68

  • SHA512

    a199adde7d9719fabd576532899b3ffca3e5584cbbccfd5f99bc1512562bf592dc67980c08a4079ea04ba8c1cfb6c9bae434389d7b09ae4b5c3b9e9e97916cad

  • SSDEEP

    24576:+eu3MIZhtf/wZXmM28FeyV2xefthlIWrGJ:+JMkhtfEmN8FF4WrGJ

  Score

  10^/10

  xtremeratdefense_evasiondiscoverypersistenceratspywarethemidaupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2