Extracted

• • Target

    f26ff62e5758f1172c9bd0292b725c19_JaffaCakes118

  • Size

    44KB

  • MD5

    f26ff62e5758f1172c9bd0292b725c19

  • SHA1

    077b05615bf744263884cae3bf3cb28caf437d7c

  • SHA256

    e52adc5747dd4896b196c72450e8b017bbb67b1f67b6bf7ba27f489d4a1590ab

  • SHA512

    f999482d0d3287a3206d4b16c0299742a2bed9c3d07f4bdf8fbf6e7d58e5896f4a51166464a53d1867d3a494f203694204c59deefa54e3f04b3e2062665c7413

  • SSDEEP

    768:1Br+tjFMTPkAlfztB1lr6anQ9mTwcuvm2DfOTwYPIVzoF:ryR2HlrL1lr6anPTbuvm2buQFoF

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2