Extracted

• • Target

    3ed813685d098c623ac97a5a50265647_JaffaCakes118

  • Size

    44KB

  • MD5

    3ed813685d098c623ac97a5a50265647

  • SHA1

    bd5384f421ffc4467dd650ce7c573bc09a6d13e3

  • SHA256

    d98beabf467016288f95803658ef9736a22cdbccf7a6e5cd07c2e8c188e424e4

  • SHA512

    a1754a5ce70fd917730781086c45eb48f47acbbc79fac2194db9e94689eef857dce397d3075e3d3be03b02439fe8ff973e0060c85474a8acbdadbc13f9a21163

  • SSDEEP

    768:BBr+tjFqTPkAlfztB1lr6an3smTA8uvm2MjCpPtzo6:nyRUHlrL1lr6an3TLuvm25Fo6

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2