Extracted

• • Target

    JaffaCakes118_7bd14eaf8161ce99890f846745e566a8

  • Size

    707KB

  • MD5

    7bd14eaf8161ce99890f846745e566a8

  • SHA1

    8dee2136f9a940f9e93a08c0e919780c990feb53

  • SHA256

    ceaa34d14ebc30f60edd3fe4daf062c0b3be394266707624d26c61671b65a72f

  • SHA512

    aa7b3f9da0019292e87708d69e3973a66b8a3026aeb434a2013f829bcdc7a68ed82a4330609d522b31f876a85171c46fbdc9b753428830d2e29fa4ef8277d379

  • SSDEEP

    12288:0792U/9U/xFCcm3GTHvp19iA3U+rZoyURijgw1ASzWhCVHE4YPJF:070UlGxWyv9n3NFWMRNVvYF

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2