Extracted

• • Target

    a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118

  • Size

    755KB

  • MD5

    a1afa361dab7f2a129e0d6a7d79d6fbd

  • SHA1

    967fb6c387fb8b7fb6aaca5d2bc91282f8fe11f2

  • SHA256

    e930fe9f06b1692b7486305fcc661b213cc290f6b00c681e75386293107a7feb

  • SHA512

    c0b06b5735294c00c9950be1406f5b6cd845a569af0f5d8c3b2c0d63ba122135d715dd2a5eb7f48f25a3925808af61b11fa23a80c07d1cbf355100d2764dad80

  • SSDEEP

    12288:+Ma65M1l92EiqfUC/wnTI7NPMKkp3JBRvqwTlXndGvnOx7mx4UJvSxjtVAkK/omp:+JZZsC/vxMKkp3JBRvqwTlXndGnDExV+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2