Extracted

• • Target

    JaffaCakes118_b3338f0b3999f08d48e19a89fc45e311

  • Size

    126KB

  • MD5

    b3338f0b3999f08d48e19a89fc45e311

  • SHA1

    2899496275e0caff09b70f32bb041918b3e5b0d1

  • SHA256

    42e83c904f3c430d7fb008dd4d7e599c2965d51f1f11fddde91cb41ed3c9563c

  • SHA512

    595bfebbc62bdd7c346528b4ef075353cea998228daeb1d9286ef6e5e08683976fcd21e888d5da28bbb2911e5140d6c65f826ce4c95610bbfc818ed1039abc21

  • SSDEEP

    1536:dpqoQUMtCdP+iibnf90jLXlC7zKl36h6G0pxoBwPU1s1wTKFJR18T2hz6Ziezbay:TCtU+tbfvA36YFpxKM6TMaQ6ZW62Up

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1