Extracted

• • Target

    JaffaCakes118_410cd2fb84ee3f29ab01f5680d2f8987

  • Size

    65KB

  • MD5

    410cd2fb84ee3f29ab01f5680d2f8987

  • SHA1

    95f7be7bcef5fb88c058694d60f6087c85ccf3b7

  • SHA256

    bc8aef38da0e4e5490c22bbbddde839e5a6dccd7e94529fd8227c664ba0a3e94

  • SHA512

    07404307acfe021dd0bb115e0500865c855be5655001d7ad8698acd3f7c5fd8ff4c8e2d4cb4973155ac74176e0e47469af63e259981d44e263d01cbe1775e729

  • SSDEEP

    768:e8m1Sq4NQErBsH1tzoisBKQI6dObAG/dqOXHsoAx5JXrUqLOY0pYKnA+7PoNwhzX:ssq+QV4rObAdNoAf5UqiYmlArNwpoc/

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2