Extracted

• • Target

    JaffaCakes118_2008265e71c25e99fb65148aa00b9076

  • Size

    113KB

  • MD5

    2008265e71c25e99fb65148aa00b9076

  • SHA1

    ef9cd0137faa210d28ecae1c8e4296fda93b2a3d

  • SHA256

    2b72724feb8dd26bb227f7d4f2129954d59659ef490dc27875ebe3c93ebf19d7

  • SHA512

    d9ac3cf8f16b10545806382f82ec1e00d99c6087ecbd02b11b4936872c8b825d3c33920b8cddce0081f0c488b99e4e60c8b7b85fa0065f95d4006905a7b36e95

  • SSDEEP

    1536:8C5p7b0RGwWtTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xOPcJS7:8Ido8tEMF+ErFnJkUmAMVRccJS7

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2