Extracted

• • Target

    64c0c5260f59f5139120feaf9e547f69_JaffaCakes118

  • Size

    41KB

  • MD5

    64c0c5260f59f5139120feaf9e547f69

  • SHA1

    9d98d6868b7aedad0e98f2ad06cc0583b9e8300b

  • SHA256

    22873ebeed83bea0d9a53d6f82b0747eea9588fbbe4ba9f5b57fa33124398ba6

  • SHA512

    e37f825d980cee2ad4de43e1a829d17dfb8d7bfb697f832673d29f94046b0e925c8e3a37b6f4f9ce50fcfddda8ac701078a7971e324a6b616bb288ec613ccedc

  • SSDEEP

    768:+YBwkX1OuEl1wET2e78mfV5C9PDe7YpKIqbANXmqFnrw0Md4eaOxYIPAujivLiiI:Rtc1wETnomN5CRecvrmqy0Miey4A2iX0

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  behavioral1behavioral2