Extracted

• • Target

    d78c21554d13575159554cdaac8a666c_JaffaCakes118

  • Size

    604KB

  • MD5

    d78c21554d13575159554cdaac8a666c

  • SHA1

    5329040e2a48ef7da2371f5200e1dd095a43078b

  • SHA256

    46ff1f3bb69576e5f2d84e4345b64563ddbc69b83b636f5560c6019cb0e97586

  • SHA512

    05dd7bc810580c791d98b3541ffa3189b56c47e19302da689c1fc5180aeda6c1c3b572c59118c6fb7b34f8dbbc0d9ac8a9cfb5aab919b36c79f850187b7ede17

  • SSDEEP

    12288:s9kTo6UHsw8CcjW7oaUUMzsEXrq4lpw+BwQ5tyNf+CkJQMzEMY0paL:FT/UHswIBaUlsE+4lpw+BByNGCyQMIME

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2