Extracted

• • Target

    a8b06620e9629037953a3a5bc07a0b60_JaffaCakes118

  • Size

    45KB

  • MD5

    a8b06620e9629037953a3a5bc07a0b60

  • SHA1

    08c35cd4abf5e0945182079e24ec190d97225775

  • SHA256

    c01c3e39933ccfedaf1d766903232ada996f71ee79187a2cb420219000c97d21

  • SHA512

    042cfac252c4ceb55b9b7e5fb7f23d5686c4b3aeca68b2b093a3dce78d29f89f66745e685a9cefdb07db1dcf69a2daaa4286af185a2f9cc6040d3cbc5c0b9b50

  • SSDEEP

    768:DBr+tjFKsusi02s2VzfoFTrS75YAU074/uhXtYCpP0zo3rI:tyRQsiNVzwFfS75YAU08mhX5co7I

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2