Extracted

• • Target

    6e48070fa946f236a14394c06f21e2d1_JaffaCakes118

  • Size

    552KB

  • MD5

    6e48070fa946f236a14394c06f21e2d1

  • SHA1

    bd6476462051ce2f6c5f8037b51951e49c56831c

  • SHA256

    977820fcfce4bb8e9af2b5e4c505b668a56c0a29de6c623cc3d190fefb4e259a

  • SHA512

    86fbacefe6e3f28e9f1354c3d9cd47564e70e31f220e61bfb0e50d13d5531c491e6d91f6a30a14779645a7127024046e6fdd2bd32bcce20b9c3b631bc5e5ae9b

  • SSDEEP

    12288:9tB3ghKLWZTPJQy0VYP/wSuZqbNrMsKpaDUN:9tBMKLW7Qy0W7w4NrVDC

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2