Extracted

• • Target
    jaffacakes118_Trojan.Win32.Buzus.ojzp.73b7b723f44e119f3209c4a7e1524a77
  • Size 368KB
  • SHA256 6c57f488f48d97269866a83ac986569a06b7971c5d319271fedbfdf72855c2d1
  • MD5 73b7b723f44e119f3209c4a7e1524a77
  • SHA1 dabf5cd5210d74cb1f7d6073d7d89e62f45303e9
  • SHA512 bcc180d7e1d5e969b61b6295ded74e807b78d7fa395f07593687d4e658cfaba4caac7ade81771457b211b21ac5a5ff5d603f8359c4088c9d1790f9d238d739f4
  • SSDEEP 6144:pbsKnM15hdx4ynmTuhWpfX9hCbgMOiJsDDfnpPX8cXfH0gftson:eH5GGG3/UGHDDfNsyfUg
  • TLSH
    T124841293CB988EBBD6192CB841139D721359FD15BB4C1BA348256E0FBD35237BB03629
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • Family: XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2