Extracted

• • Target

    JaffaCakes118_13e1b45725c67a78dc5e62e6c29e0adb

  • Size

    40KB

  • MD5

    13e1b45725c67a78dc5e62e6c29e0adb

  • SHA1

    142d85d87180fb5c3947931ca1a45fdac3a63bbd

  • SHA256

    6c2d26e4bb26b0103f591b5ed3008b23bf7a360bca8aaaf1eaf1edb3b5e0e592

  • SHA512

    6c8d2963511ebdf598d3fb3b994406490fc1e55a40afacc6f3b7dcb1d59bfb9cf7832a1ee3ec102898d12e883ba2a30baeef275239a089ef7f221aa91c0f6464

  • SSDEEP

    768:bxjxMezQBWXf9fX6pUqB5KpwkIH5AO9ny1hX8dRN0vwhlWZGzxPbPrRh:bcea69X6R5KpwVxyn8R0QWZwt

  Score

  10^/10

  xtremerataspackv2discoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2