Extracted

• • Target

    0d963ba57cbc4a0ed501eec8eb8bca1f_JaffaCakes118

  • Size

    324KB

  • MD5

    0d963ba57cbc4a0ed501eec8eb8bca1f

  • SHA1

    9d169af64d341b74d5839e33367bb3c6af79a481

  • SHA256

    f44d867d2653e547b9988a37379d562437486802b310e0b15c22ab723c8a9555

  • SHA512

    395377390f8f5841bc547d1366025c50fe6801258c1a1d326f5902328f31675b5889ff6592735208b201530a23bf3c62ab82c12c4ffa3dba4409dd2c7af0759e

  • SSDEEP

    3072:emMm3mUGV3i7/tqJpBA/doPS3K15mShsng2:emu9A/doq3K1Dh

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2