Extracted

• • Target

    ad3ecf52e68a2185b53304bb858bb609_JaffaCakes118

  • Size

    596KB

  • MD5

    ad3ecf52e68a2185b53304bb858bb609

  • SHA1

    6d56e98364b99987d296cf90ab2ab0ce1448bbef

  • SHA256

    3d18aadb4d297bd0173fb050a1907c3a1f6ea93142264fab50790454474afa34

  • SHA512

    33f7278f6b50212d05e235dd0803c6c54d322f11298d32c1d5e5a96e76deeed80d38eeef4b098d911643c38ead28ca806a55d4a9428450dedaa0407a3aed10c8

  • SSDEEP

    3072:YfluM7g422i4SzgHkdXEgw8bPba3xv68ERMHtbirXDtAvd46XFTmK11NfN:Yfki11h

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2