Extracted

• • Target

    629ddaa1af4860f643b018a84d154e6e_JaffaCakes118

  • Size

    91KB

  • MD5

    629ddaa1af4860f643b018a84d154e6e

  • SHA1

    12f2d0b47d55f9e3b4ce214fdad8d971976ec098

  • SHA256

    ac1a0185e728b9fdffe817496d9dfd33612f454e4a9af8a97cc458f445cb3133

  • SHA512

    cb627f7785b4209bd4c8c91bbfdcaac6b88ea6c69697d88e91242685d7702e63421f6f83555ceea52a604c4e28296fd8b1f01ef633ea6ede5a9697c737fdf41f

  • SSDEEP

    1536:dsq+QV4rObAdXWpf/y+7ozNwihURDoq4OZZZLlCIibyoM:E44rj/WodeRD68wbyo

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2