Extracted

• • Target

    JaffaCakes118_671ec688cbd6ea58c6dbc73883e3d036

  • Size

    514KB

  • MD5

    671ec688cbd6ea58c6dbc73883e3d036

  • SHA1

    0cf3e68ef37c43f96c5147908901b446f2a634bc

  • SHA256

    504ef733f5192ed63ab730b6895cdf25a964cee0f4308f63a6cf4d678c77676b

  • SHA512

    fbddbdf308767f6361eceb4d9e6ff9e2f7795aea6b49cc0650d90ecf47d207fbd70718e79961f086e7ff3ed1a00d6cbae861b713904466c07a32a31a80d348a3

  • SSDEEP

    6144:gAnDEjA3sVxW6ibaBH31pBukR+amQHifGM3ufJMoVhPaXw966y0Zq:gN26ibaBH8QH2+JbV1agpI

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2