Extracted

• • Target

    ed8b4f73f551891b781a74365549a514_JaffaCakes118

  • Size

    1.0MB

  • MD5

    ed8b4f73f551891b781a74365549a514

  • SHA1

    be21daeddeca6a221e10c25753f24799fbf7b345

  • SHA256

    3284a173e589b196130a10eb56183e4293bfb8e2e12938fe8c03e3134f3e6dbe

  • SHA512

    547b222a9f634e2c520ad46f22b963b75641d945c9eb83aa690a5cca741f4509e73495a4c6944fdfbda40b7b05e1c049a2019d067308be88b5a65b6ab9c2d601

  • SSDEEP

    24576:Xbmc/W0LYQribz44VybwhuM5ekfgHXMLU/ytvb0k9kIa2:X6kW00QR5U5TU0U/yVb0k+Ia2

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2