Extracted

• • Target

    JaffaCakes118_b909c3fc98345b9be8e0506262e622f0

  • Size

    122KB

  • MD5

    b909c3fc98345b9be8e0506262e622f0

  • SHA1

    75877e0e7667cdc8a582bd73efa8e7eb14a80d25

  • SHA256

    c569d6c7b582827d7e0d88abf43dc3d1bb32b592a62eb6680ef6003ddac8f7d1

  • SHA512

    b5f6ad5c24138b22bae7565fc30c42652c1f0ddc5a0247203ff582ccd121f03eb977680df8eede76d300e9669f815164f448ed8c6c117560d3b08965f16c1ec8

  • SSDEEP

    3072:DeO8mnblktLMMMMMMMMMMMMMMMMMMMMMM0CyBRPC13CG6IeqXjERCMyKFfJ2oeLW:1lkVMMMMMMMMMMMMMMMMMMMMMM0CyBRj

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1