Extracted

• • Target

    JaffaCakes118_1af0cf6c39c150dcf4fd8a2c425b8610

  • Size

    690KB

  • MD5

    1af0cf6c39c150dcf4fd8a2c425b8610

  • SHA1

    ae2f70d2937c9297f25a4de987a53f87f5d31166

  • SHA256

    aeff8acbaf53e321bcdaf6574cf183765383ee3229d5c5903d1dc6ed2f21b150

  • SHA512

    900899ebfe375ef120d17f6b1c3174a872c66dd98ef69f8ad10a0f168de756e1e225d0736ec88c060ba928afb9928d7fbc737b47067f964f49acc58720c44a4f

  • SSDEEP

    12288:TOqBSaE2ETJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYfq:KCS2E7z193Rit8UJ62Bmhgeq

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2