Extracted

• • Target

    25611cee5330e2e3605d7196b83d490a_JaffaCakes118

  • Size

    65KB

  • MD5

    25611cee5330e2e3605d7196b83d490a

  • SHA1

    4c27dcd61103921a044de21826530349d382bc18

  • SHA256

    ff2d7b82b6b2a2ef1d376ce508fd7e2deea686888ce16afbce5ff256f8ae6664

  • SHA512

    88d2d82c5e36abdb78e1028b5b1f56c83cb2f5a8df2467d9d1c827c106c9acb24b12bc755a5d3fa0bfa6e5820658f40f6fa224126a9b3125adf12beea1b729fa

  • SSDEEP

    768:d9m1Sq4NQkrBsH1U8z05DeeQuMVTyN8ipHo37Vmd6AeXVtWAJ7A+7voNw9ASwB/:asq+Q1aZQuIyJp0mgA+FJ0LNw6/

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2