Extracted

• • Target

    e871ae1b1e0ea2e3ed2323c30500bd86_JaffaCakes118

  • Size

    150KB

  • MD5

    e871ae1b1e0ea2e3ed2323c30500bd86

  • SHA1

    a365235936275482bc3833db78aea59a441b7201

  • SHA256

    de16ca84525b3f4230bdb6a37f5149760fdbd430f5bb17a0c88044907b585b40

  • SHA512

    5ab1f1db9c28c20af7bcc4f21350ccce9f3cf72aefc88b24bf07e5ed50ac1f23605c39cae89d04b04a4fd32a7d83770df67899cc883a5d83d2c04706f6275ea5

  • SSDEEP

    3072:9UrL1ens+KOLd0igVeANMwnieFsStRwbj2z72lfCh6mv9Y9N:9G8nseLd0igPNMyieFvAn2z72lf

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2