Extracted

• • Target

    JaffaCakes118_78da53408cd673fd3051565f8e6ba720

  • Size

    95KB

  • MD5

    78da53408cd673fd3051565f8e6ba720

  • SHA1

    ffbd94e0763ba9ae7ad39fd0cb0f290b9c587a43

  • SHA256

    b58cdf6d969afb01e8cf4ebd21b01b53ad0ea53b1d0d8126bf7ba4ca655ab3e9

  • SHA512

    8cc107bad54ceebd5c5599115737ef53f688d8ffd26aad61227b5a6da3858b64da778ee3f8bf1313ec0c5eafc8a60aa8cc84efc8b1d0d09339c80bf8ed2cf4fb

  • SSDEEP

    1536:8x70xyGJ2d0OA8Fgw3DFhBrtouYsn70vQviEcXJ4s:8axf2d2jwzRpouYsLi5p

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywaredefense_evasion

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2