Extracted

• • Target

    JaffaCakes118_79ad99e401b7c8d6d11194d3136e0777

  • Size

    170KB

  • MD5

    79ad99e401b7c8d6d11194d3136e0777

  • SHA1

    734833033aaa79dd010ffd0aa6e87633d08d66fe

  • SHA256

    7b03186ab37b808a1735e79b1a4512237602cc1051fd3a23bb656140be329cc8

  • SHA512

    2b5e6508ef6f13a0974ac53071fc0f704af5ed46220c35cd8b89514bb895a6f6115501ed3c495b47c6867eedc14553559249769352001c14be3f17c454cb10a7

  • SSDEEP

    3072:Z8hMYQReUWNA96HM0XnpvTyQqGfiExDlKbHluAnZ0ESsz8XF291GiS+SfB5x/GMw:C278U2U4TyQQExDwbFuAZHSsYV29zS+R

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2