Extracted

• • Target

    ea290fb2b0e8b0739d1efc413bdf1446_JaffaCakes118

  • Size

    44KB

  • MD5

    ea290fb2b0e8b0739d1efc413bdf1446

  • SHA1

    2c993f99540fc51766d0cc51138172789a9b5e0f

  • SHA256

    dfa0db81a438c55bed8df439e8346f1637379f02318f10700763de0acc7c5bfe

  • SHA512

    b8162428ef642656fb6f90584104183316b2a81fecd874f62e1de2a2905f19894b0be3b1bd850bd393e63fdedcc05748ed174ba683164f0893bc5ccb728534b0

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6anXsmTg8uvm2DfOTwYPI+zoJ1L:FyRUHlrL1lr6anXTruvm2buQCozL

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2