Extracted

• • Target

    832f2b111403ad8ba6994a6edd624fff_JaffaCakes118

  • Size

    764KB

  • MD5

    832f2b111403ad8ba6994a6edd624fff

  • SHA1

    f4d8334159868ee2233cfa38a100f58a65651523

  • SHA256

    8e85fd6cdb0091d060260384900869536ce00b202c00ec1627b0930808a3c93e

  • SHA512

    0d4dccadf8e651d01cadb0895646b52169ed9c51d76764a87864351ec6801c44ec02d742bd4f90bb71f745f2c5783c6414a5a3d347a7e35d040f953de351ed03

  • SSDEEP

    12288:h5mt0idn673b33FeokUwwwMMNoOrAAgQCRwp57HGOvQyUgSG:hwtF6wYez9IywG

  Score

  10^/10

  discoveryxtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2