Extracted

• • Target

    2e057bdc64d92257da093b2d3aab418c_JaffaCakes118

  • Size

    113KB

  • MD5

    2e057bdc64d92257da093b2d3aab418c

  • SHA1

    0fabcd2beacdbd9db0d76a805a0c3229e2428c90

  • SHA256

    6bee8c074404069d835722ee149e198ae3285ff3df772ac5f043c6ea0a7e5f0d

  • SHA512

    f6311d29d5c1a28581ae258ee5ab39b5ec0057a92b863af99e7935e34cbc932726d16676c8ad1292c446d223775d4b5023057c74bba4abcc0dcf4112280db961

  • SSDEEP

    3072:BKTwQ7Y6FyA0nQe9ea/VWifSZfLjibnxyXEvaqM0:BO7j5IPf0LjiZF

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2