Extracted

• • Target

    24447bd9ec7ad676742726886d7e7f8f_JaffaCakes118

  • Size

    553KB

  • MD5

    24447bd9ec7ad676742726886d7e7f8f

  • SHA1

    549df29da494636e9c73d0f6622e90f26844c27a

  • SHA256

    ccfed1429dd37bd1cf323f28fa51a15fbe3c611d37f483c699761dfcc6a458dc

  • SHA512

    74ace8cef2c722fa98dc99238efe0e6681e220033132322751c20cd2d14a67dcdf3b02dd027feb468b441373643cf05597c33850b164148f46d08ef126a2b319

  • SSDEEP

    12288:4QgWE1heIOmMIQvzkQkTrNbkKgF5JvkLpLY7:43WSeIOATRbkKgFvkBY7

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2