Extracted

• • Target

    JaffaCakes118_b09702c7c62046f0e3296d3e76ecbe66

  • Size

    470KB

  • MD5

    b09702c7c62046f0e3296d3e76ecbe66

  • SHA1

    47236faabaede3e2104c150f315ad09a8b8eb83a

  • SHA256

    de0d5c183ede36015daa4c1fef9d969cf30b58ea0a0cc7b08d1ae7b6b33b2150

  • SHA512

    14c7b4600fede3df47eefebe6028ef1c9a046eca9ac445dd94e2b72acf5940c75a24b2400fb904a8648e67da62a293ffc8f920996939b20cab5b721c3787de2c

  • SSDEEP

    12288:jN8vl++fLGim1SEaANsb7Jw+/X6PST91A5XJeyxzuVRFGXLERl:jC++fLGim1SEaANsb7Jw+/X6PST91Apc

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1