Extracted

• • Target
    c45ab6184d8eb1407aeb9b4404340be3_JaffaCakes118
  • Size 371KB
  • SHA256 03c4482ca7fcf996fa0851fadef694fd3eaa7a878dc64d7cc29fe051a9ac066d
  • MD5 c45ab6184d8eb1407aeb9b4404340be3
  • SHA1 205c017e57b403ba2250ca0db48e0f4eb598fa33
  • SHA512 edf4dd7308de52314e78e84227ee33c1637fbecf23881982329cf1c6c7d360d83b08ac1a06b2f7498eaa50bc5720741f70497e4bfa0405df78d4721598a33b31
  • SSDEEP 6144:LZqoI1g3rJLCRgJyHxpxA6hz4VPy8SmR7eanY29rzXI:LZqoIsJLCWJyxzkAmBnXBI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotxtremeratdiscoverypersistenceratspywaretrojan

  • Detect XtremeRAT payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2