Extracted

• • Target

    7aa95910802295f6717ab9d9beee1898_JaffaCakes118

  • Size

    182KB

  • MD5

    7aa95910802295f6717ab9d9beee1898

  • SHA1

    14284f8090ab40b02237d401704ba1af54bd9138

  • SHA256

    413c6b51a62ef628960a2c8596b6cbb9906063b234939c3bb80be0f71d03fd34

  • SHA512

    23cc0c4352842e62f069a6036d6ac055740328a64572348d526dc8478928afe62409b89e40f17916b87ba3c033aefaac1388ea77e349d23e85e05d41fa794962

  • SSDEEP

    3072:Rs2XZfZhXlYDVtNH44iyIF96HM0XUGXU2Fo21364EoiJeeI+StSqYLj8MfseRlP1:XX1XXWIpnVW5GJZ2tNYLj8MfsCX2HKWK

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2