Extracted

• • Target

    JaffaCakes118_c5cbe327f87f86b92b574ec9ebc775f0

  • Size

    1.1MB

  • MD5

    c5cbe327f87f86b92b574ec9ebc775f0

  • SHA1

    da3f4a5039d81ceaeebfead9088bf74496aa307f

  • SHA256

    90f90ec0e43c9fff1046584c1b1b7d4095d22d0374ebc387ea6e8b1632afcd3f

  • SHA512

    59b02c96fef4f158fdbff04682d6917197e7e7dbc2828f6a69e2bfa1de5e14560acb5b3fa69ef3f8b6c0643e2ca1c22349a8df524db5e37ac77df9687a8a365c

  • SSDEEP

    24576:xCnCp7eUQYU5q4Ypnx8DpLjGMCyFLjYGCsYFdnocS:xCnCp7d/bHRSd/pVL0S

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2