Extracted

• • Target

    JaffaCakes118_8e071395d021200cfdc4c286b3e85e9a

  • Size

    113KB

  • MD5

    8e071395d021200cfdc4c286b3e85e9a

  • SHA1

    66ff12aeff616501903828be2a4db842c47c17d9

  • SHA256

    8c6d6514f0cd7af9defc3b46b1553d8ae2ab73ec6270147b12ed166e72ac1e92

  • SHA512

    7782fe6249d7416ef5e2e1f51ba3f108a0adc9a3cbc44b012b3948d77a9e9df632d4ec4df54f6dc77eec8844d4c9b061d409e22be0cf6148f2ca33d2b4dcae78

  • SSDEEP

    1536:mC5p7b0RGwWtTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xOPcJS7:mIdo8tEMF+ErFnJkUmAMVRccJS7

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2