Extracted

• • Target

    6585a16b111cd1a1d4992050a6207735_JaffaCakes118

  • Size

    297KB

  • MD5

    6585a16b111cd1a1d4992050a6207735

  • SHA1

    817cd0f83fd70a49d0c7336175f507cf4b989058

  • SHA256

    9ad895c6c959ef97efe53a5ac2b2f1a3c335dffabaf919faf5083b16e10d5450

  • SHA512

    0fa51be1433d2060ec09748826ac03c230b8b638d661af09266b909533ce147e2a450188ab9a73e332ee20928f94ae8e5f62e7285dbfbb788ba119871f1a1e3c

  • SSDEEP

    6144:nhWxjk0EdatAbulIY24ku3n6DJRMqw6B+HaBZz0mfA:nOjk0gatIMkh51z+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2