Extracted

• • Target

    JaffaCakes118_1a0a6597af66859243f756f6fde625c7

  • Size

    412KB

  • MD5

    1a0a6597af66859243f756f6fde625c7

  • SHA1

    899c54d6258278faf91a5c7adb382253e6b19d5b

  • SHA256

    31d9328a5c77b2ac0337798e3102952f99ddb4926328a1af6ec2573c0cd21a47

  • SHA512

    3fbad6b94a08933c2a26227cfcccbb4f408de2b1499ca18bfc54f5522a076793dd485ef94589c4ab734951f49b3559c6d66e850f09487ea9e2e9adc96381c142

  • SSDEEP

    3072:gF+jfPsCLt5oMxHLXy7DWhiU/mUpZ1KeIDmVVaPzrc77OWw8x8conyDldbcdzvTZ:RNR71eCZEeVVsc769/concldbs+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2