Extracted

• • Target

    JaffaCakes118_869e2a92cee12db45574ad7155638193

  • Size

    44KB

  • MD5

    869e2a92cee12db45574ad7155638193

  • SHA1

    7dbf5273c704ee9aea4141583c545ebfefdf2092

  • SHA256

    ab0390eb9f1518061c09f204b5590b69a5f124995747475dab674dbff9f995ae

  • SHA512

    ef45aaf570dac948373010d50f19e8c747c89b1be66f3ac632d09ff2e029234792477bfc86702273a62784269679579a5112a00ac8ae0141110d47ab01576e29

  • SSDEEP

    768:1Br+tjFKTPkAlfztB1lr6anQ9mTwcuvm2DfOTwYPIVzoF:ryR4HlrL1lr6anPTbuvm2buQFoF

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2