Extracted

• • Target

    65e2d7cd7cf2c0a390dd501798826b2d_JaffaCakes118

  • Size

    180KB

  • MD5

    65e2d7cd7cf2c0a390dd501798826b2d

  • SHA1

    a3befe42e07faf04608496c617cbc360fa7dbd84

  • SHA256

    20597d177037b63423ff51e0af58aadfb44b722b8ba96a1faff8dd2d5b9ced0d

  • SHA512

    7d3c8dabc8c2cd3c650517b11651f00a75e6c4b5d18f6664928bb7b5793402ce27fc43f195bdb458acfa4c4af37b48f6e63eb9dece50d209c4de4f083874608e

  • SSDEEP

    768:JNcVbR6kdV2/jJu7s8TCe7xWkGjx/bPriUWUGTxFbPrlpWPGyxebPrK:JNcZRYyTOwWkgPWUmPWPQ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2