Extracted

• • Target

    6b5aff3593792c57b9e2f7ae04c0e22d_JaffaCakes118

  • Size

    45KB

  • MD5

    6b5aff3593792c57b9e2f7ae04c0e22d

  • SHA1

    ea5756ce55a9272279818d500befea1b805f8afb

  • SHA256

    87f93efa3b4fbbe1d50b20347fd40b4870d39a2fa8f9d31b2b5536b4426adb1c

  • SHA512

    4710776f5f1bf33de70aebf4f5e5ac0c16c8f42ea9541b7bba9f69873fdfaec7cab371e50d57b41e0865afe49b11e90a7582f84288e3c50f54ee148ce2cdbe71

  • SSDEEP

    768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cEzoGTdCJ:jyRh31jxPEFQXak+H84bRoFJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2