Extracted

• • Target

    JaffaCakes118_cb26c3b50bdf020ff903991a2b876af0

  • Size

    103KB

  • MD5

    cb26c3b50bdf020ff903991a2b876af0

  • SHA1

    ad4f57006fa3802fa3df5db801807bcff49f1646

  • SHA256

    a33051c4f43a72b59ebdf41dedd0447f8baf7bd55e363bcb838fe1a367af3005

  • SHA512

    3ae9c245b724641b648a5915a88b99e5eb57edbf89a7e295efa6b3e6e6d6addc63af1369cc17db94ec6b86c541a3fc1e3195ff28aa7e19b65b645aa7330c4ae2

  • SSDEEP

    3072:eRl3Y+TR8IdqARyhtk8YO4hD8MqpPm2QHi:eRloETDWK8MCm2QH

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2