Extracted

• • Target

    JaffaCakes118_a7c494b801a8a38069f5f359ef71e4c0

  • Size

    27KB

  • MD5

    a7c494b801a8a38069f5f359ef71e4c0

  • SHA1

    1d6cf2f1ad89c808c7e8de283f5f4df2732cdb30

  • SHA256

    df8345605f28f817bc6889599b6e29c3a80f9b083f500e7fd99e1ef57ca5c8e4

  • SHA512

    116211a3a8aa748c4396e1629bfb9164790156f30905132a6acff93bdafe769fd23dadea836dac474cb9c66b0ea752ee4c69b67eff35032e815c68bdaf6a72be

  • SSDEEP

    384:MhCngpS9DeXZSKzW56GP1MgGsFdlLGWptrhN7DGo80S7vvxlL2D:lngpSEgSgNLp/5Go80S7D

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1