Extracted

• • Target

    bec610acf1f7241d3f4d91bd227b84a7_JaffaCakes118

  • Size

    308KB

  • MD5

    bec610acf1f7241d3f4d91bd227b84a7

  • SHA1

    8baa92c39b5e5d8f173afd9963e90d6e352088e2

  • SHA256

    726fb33f8f6adf52571449a941cf822b98337403e920f9707540e4f69d115ced

  • SHA512

    76381722f922843135cae235ab22bd97fbfe7a12da69e7afdee1b1a7c99fc0ee2380a08051958f8d8004a3419dfcc823b1029363df227693225612e6eb5f2d7e

  • SSDEEP

    6144:jJjdcAX8NtvBTwOQUl1eMX7GKb4yvn4ODmq:ljdT2vVwOQ2MSGmff/

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2