Extracted

• • Target

    8ce42c472d725fbbdc9fecb5301d6cbf_JaffaCakes118

  • Size

    44KB

  • MD5

    8ce42c472d725fbbdc9fecb5301d6cbf

  • SHA1

    a14cf82de73d4ec19b21f2b085af542627270660

  • SHA256

    f7acf23ba90a050d73318b85f1411942f83a7638d2d5d2315079b5a0c51536b3

  • SHA512

    122545ee5d272610f32f883d2985234926787ed513a6ccd95cd78c3a0cba49256e65f5eb4fed476b66dd4d1da1d06c05ec2d7a15e3db9c1ae74a432b27d91abd

  • SSDEEP

    768:7Br+tjFqTPEAlfztB1lr6anosmTA/uvm2DfuTwYPIGzoiQ:VyRUnlrL1lr6an0TYuvm2bOQaoiQ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2