Extracted

• • Target

    JaffaCakes118_22b7f85ccfd652cfb2ab6317dc3ffa3e

  • Size

    350KB

  • MD5

    22b7f85ccfd652cfb2ab6317dc3ffa3e

  • SHA1

    df859c09748a53e44ae7db06f7b5ce99c16cdd38

  • SHA256

    3de64d2a48cfb087956479ca7e93f132cb7eedafe2a4ef2f10c2d958cad8da57

  • SHA512

    8f6124a9aeb2bb7a2c96ebd72eb49ceccbb439347751c208a1512afc8c1be43a5995a3ceff19fe62c5270f82faa9d2705c22c9b0156a64994030f2d7ae745ef3

  • SSDEEP

    6144:tpkVKoS4DZ3A+E0I8IQB2vI1CDitFuZtzzk7fPxSnyVNck/iPJgsROBevh+1HNXZ:t6woS493ACIl7vI1kiqHNnyVek/a4QmH

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2