Extracted

• • Target

    0d85eac1231895c7931dfe36d50a44eb_JaffaCakes118

  • Size

    448KB

  • MD5

    0d85eac1231895c7931dfe36d50a44eb

  • SHA1

    e03ae2b24473ac46440af570c1b48aa3b22bb032

  • SHA256

    6ea117d4d58dd5ad3dca68457e9d64629c6fb4279fcaf733710988cbf6d36685

  • SHA512

    db3e582ea5090836817cd4f60a5780fec2df7f3b8a11e4b85de30420e7c9ddb9a0ff1cd6dd69856d0cb363368f2dd0fddcb3b60f0399fe6fa644e71c6f48aede

  • SSDEEP

    3072:J2fiQUShCEJneq1DT3AZMA1b1DT3AZMA1liqbTKgLF3pp341DT3AZMA1:xo1W1UKgLF81

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2