Extracted

• • Target

    1642421e567928b38b37458d9f25feb0_JaffaCakes118

  • Size

    45KB

  • MD5

    1642421e567928b38b37458d9f25feb0

  • SHA1

    6d31498897d906774faad71ab1326b342f001a10

  • SHA256

    a73039b543e61e7130c4f182f96e6fbc925b11ec658f87cbcf81fd174967dfad

  • SHA512

    892b4f7a58aff66cfe700d0518da35c5416d4fdb0ddef8a4d065a3203551c19e85a274a0a94addc78e9db7b3052f93d067d05df34bb5e47c4eaf23f9ee5650be

  • SSDEEP

    768:9Br+tjFY90iY6W1jwm3zKgEFQX6klMIAnH8hwfOgw08gzo5J:jyRh31j1PEFQX6k+H84bFo5J

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2