Extracted

• • Target

    cbdc4f51229c2c2e43a4d9f0665e25b5_JaffaCakes118

  • Size

    65KB

  • MD5

    cbdc4f51229c2c2e43a4d9f0665e25b5

  • SHA1

    495f6144bcd1f03fd2bbf79e07b079da70c31288

  • SHA256

    829cf380ecf4934039f0e64ca10703cb820cd27c125a60cdea290fbb2e1d9759

  • SHA512

    f23dbf2ca761eb25e5850d4cb7d4c17d3d825c9abcc0fae1f7df311cbf93caabfdacb5ee8ebe82cf726709cd3302743591d5fe78fd1743abe8baa7e0a5208de4

  • SSDEEP

    768:i8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7Xo8:Qsq+QV4rObAdXWpf/y+7ozNwinboXEq

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2