Extracted

• • Target

    9d161a64501f679b04f29384f21d74eb_JaffaCakes118

  • Size

    702KB

  • MD5

    9d161a64501f679b04f29384f21d74eb

  • SHA1

    a04e0435ae25e740ce9de37e472af8dd028de6eb

  • SHA256

    58de042459482f23ac84b89d9bf27c37ca448aaf2e8c6dd8f66cac33ae27b27e

  • SHA512

    5910a1bc761bb5af9988e995caf6e5d6a4c80b642df9c80a00d723c8bd371f28a62031273b10e48775773ea9cfdc834ca6ad2aa6ea4011ba897237c8699e28f6

  • SSDEEP

    12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCc6K:uRmJkcoQricOIQxiZY1iaCcr

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2