Extracted

• • Target

    JaffaCakes118_866c66d6f7543e9707b7ac2363bb89de

  • Size

    61KB

  • MD5

    866c66d6f7543e9707b7ac2363bb89de

  • SHA1

    8d9d176c57013dd87b8b1e0b941cf4a7fbb11b4d

  • SHA256

    ec9adf81ba9d9d46eaf2f118fdc93c135368e34b786414db1d2edf05ac278fce

  • SHA512

    fa66e23fd69cc8b3cec3b5b9e564d27edb3b8d3233b414c1ae28338dd8fb4a4bebb53d683f82ed6774ef23f5deb886722c34dda8c2b72cf1fe484f9257f0cccb

  • SSDEEP

    1536:pT8qDqQ8K9MKhuiUMKgP2koJ0w8tl5NXH:tqMyKQLKw8/7

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence
  behavioral1behavioral2