Extracted

• • Target

    JaffaCakes118_21641456f5ef809c84b3ff74f2d5a03d

  • Size

    304KB

  • MD5

    21641456f5ef809c84b3ff74f2d5a03d

  • SHA1

    bcfc716e8f109727a03fd0e57ffc745a7cceb5ee

  • SHA256

    d110aad58c3f1bc9d37b98e4c2d0f908146a796a1f6a3c74b2758d3622ad2d1e

  • SHA512

    b9ae592e59d1434decca05358915381cbe7c86548137295639edb66e53174d45237ff41208763dd5d6b29edc50b6695a48c5ebe1fa1c7004c2e871a380a29f12

  • SSDEEP

    6144:m5sm5eNZywm2H4/uJ4jUOJ1vwa6lxt2TN2iH04Lra:bmAjy84/uJ4jUAoaK2ZH0n

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2