Extracted

• • Target

    JaffaCakes118_227e6f0f10f251b38846518f03c26580

  • Size

    243KB

  • MD5

    227e6f0f10f251b38846518f03c26580

  • SHA1

    d5b7aefa2dc0e296d9232ce35f8e3c70d0d28d4e

  • SHA256

    6a3a5961cd5a04f70442e5595dac2957fb14c1d79ef4ae7b56b38cfcb4ba5d45

  • SHA512

    304e537a89313e65cfefe8ff0ac7b861aff18cb3e29f4cf0b2fabec180cc59607f0d70563264ac542ef91370e33b29aaf166386ae39c23735605b8b5730a3dde

  • SSDEEP

    3072:XFd2Afoka0uMMGYmKlMCJ+UrxkCkK9a7+Z3wCYdj8vK1HDvhk1eSkDyfCnewUmGd:1jQwuYKs7M3jvEu1nkaCneT3NmEQ2

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2