Extracted

• • Target

    68d3d41b7ac7785ea8da93a96ee34dc2_JaffaCakes118

  • Size

    157KB

  • MD5

    68d3d41b7ac7785ea8da93a96ee34dc2

  • SHA1

    66489d5bb0f8c716bcfcddc207677ad2a2277f46

  • SHA256

    d1db8f187a89dbf726cacde2d3f6cf4e0455d7d388187dec5158c3e3b62d002f

  • SHA512

    8140bed4e507eff542a123f805ac1383324077cb08ddd36f4091cdb64ad54f953bf6c181bc437e5d68f22f7be485d2ed099f79ac8f1443d0cf82a0f757d9145a

  • SSDEEP

    3072:PReaSi4JMr4ST+TWFtdcnWYEsm4G9Fl0/K0fe6lTTb:PMxWFbcnfEsE90dlPb

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2