Extracted

• • Target

    JaffaCakes118_7e298ba89ebc4a47409a7b55d754bd50

  • Size

    535KB

  • MD5

    7e298ba89ebc4a47409a7b55d754bd50

  • SHA1

    b98d1a74048c928d5cdbc745c4652389f0750fc7

  • SHA256

    abad4bb559ea302eb60cbcc9049a7734ea11f488f4939a3f1c5698c437672459

  • SHA512

    eadb285c1305d5e57be5dd71fa9f50678e7705715bd2d575f3aec8750f408ba781b166c2a2e93abe286ac090d8e2532957cf2a38e81ebf75c2361b8386793606

  • SSDEEP

    12288:Loi8Dyo1mMLM4kBRqaz76oa304T8I6o3Ef2/NQMjE:LoV2orL1eN78E4T1/rjE

  Score

  10^/10

  xtremeratdefense_evasiondiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2