Extracted

• • Target

    JaffaCakes118_78497f3a7ebd62775fc6906f7727d623

  • Size

    62KB

  • MD5

    78497f3a7ebd62775fc6906f7727d623

  • SHA1

    1ec61798545a67854090ff18553db80630175a93

  • SHA256

    4cb89bffb7a5f2a8a21e62b741f6da19b42ffbe932df4c0c1178ae31c88fadf6

  • SHA512

    8f91ec50a0fc5290c1e2ef41d61b27e41f56ce55a12858e721993fb3d8548effcaf921a437cc50212ec7a122b7258d71edbdc98d95f90c0f346b0d509880615a

  • SSDEEP

    1536:j8qDqQMKgMK3tGjbNwPZeZIAXHWwlHNX3j:jqcXKdcEAXHWeN

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareprivilege_escalation

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2