Extracted

• • Target

    8d087c1bd01b5abe21fdbaa3ccd47fb5_JaffaCakes118

  • Size

    205KB

  • MD5

    8d087c1bd01b5abe21fdbaa3ccd47fb5

  • SHA1

    8b1ce8ea035d0c831561e6ee3d59dbca27cf35ec

  • SHA256

    740c2f18b582ea1fcb0b92e67797f26ff2153ca6bba7059bf622af49406fec20

  • SHA512

    72f795f49156dc529a214c94da343b8ea5c8df207fa5a137108636ef9eb051be16e1e24eb5c186af1a7a42230b50ba30205806b9434eb0bbb897f9a1b76150c6

  • SSDEEP

    3072:hlSHsZ4T48Bxyvc9rfHhbfwMHDho85R/grs3+5ozbyUUHCYD2tkP9a+pkEtkP:3hbvc9VfwMHD55x3u5oCUUHCA2OhpkE

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2