Extracted

• • Target

    a56bce337090724acfb239e5fef18f88_JaffaCakes118

  • Size

    44KB

  • MD5

    a56bce337090724acfb239e5fef18f88

  • SHA1

    b8fbbb621658ce1945f2a2a688ea2df8b52873aa

  • SHA256

    30254bdef875a3a21897d6ecd8845f005721ab6dcf7fe05a17b9fa2dfd1731d5

  • SHA512

    9b1bd8a92712e37bfcd2fb4cfbf51b74ed4e35022c61c3b3e150c285eda090f40c74488b57bc58e6368a6590f2b326b9a663146fc3e3f147c18c1e24b7e8067e

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6anXsmTg8uvm2jfOTwYPI+zoJ1L:FyRUHlrL1lr6anXTruvm27uQCozL

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2