Extracted

• • Target

    JaffaCakes118_b3c7298bcfd539b7e74a169e55017803

  • Size

    125KB

  • MD5

    b3c7298bcfd539b7e74a169e55017803

  • SHA1

    eafbb294d99ad22e712b0dd10e1214d4dc980653

  • SHA256

    89eb6d8b59331ae386fb085a32b3e2c05b0b0741f0478d0c9ecab1cd21d2d960

  • SHA512

    438d27299f900dd46ccb394c24b78a63813cded59cda9370e7b9dc3da86afc3506f0a47cf960836fc26e0f1c2bc829cd517249cc326133480631527e9a3bf2e5

  • SSDEEP

    3072:36tbksgGH7NFlG/FRJ1g/+AN+vZuXcsUvE0bf:qtbkmHDliFRrg/2xuXcjxf

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2