Extracted

• • Target

    c2995fd46e8923c6cc8225674f0eb6b0_JaffaCakes118

  • Size

    304KB

  • MD5

    c2995fd46e8923c6cc8225674f0eb6b0

  • SHA1

    227cd36930efdbab49bd6bf3df8739085a4250d4

  • SHA256

    b1c2a2ebf96bfc726f04f7b601a8e0c2383fd54b8de862c4c9b6754c9a31a0d7

  • SHA512

    5936311120223c2c35ded85949cade9c6cf04d305509adf1bcadc0295a32141dfffe60c9d428c65e809e7acfbf4d19fce1587ce1e1d5fbeefd79dd2087d6e4a3

  • SSDEEP

    1536:MJC4gSnTJmTr3HiOaxzH0J+X3/Sm9VMJ4GQRyt48fvsVpCcB91qFhuV:MBnTJGiOaSJYHlVl1qSV

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2