Extracted

• • Target

    471035a4e60b031493aa30e006de309a_JaffaCakes118

  • Size

    1.2MB

  • MD5

    471035a4e60b031493aa30e006de309a

  • SHA1

    9327f2dad7eb49bd681bf9a8bccaf42fc6df9cb1

  • SHA256

    aaf985bf7fd535c4d0fb5da6a12d7426ae8742bb5e73785061b7e38080f258c1

  • SHA512

    43e78ad0c431f90cd8644dee4c95d53ec8bd20c2a9d13bc4635742fa920bc15a44c186c353a12cfe9051673cf1c6d763c317e6673e957dec87abea43cc1f2e75

  • SSDEEP

    24576:vpQt/L8Fn8XM/N2MicqB8DpkI/qgDIs0ooG4Z22NwjF8C:BQls8ytI8DyIiqIfoo7w5

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2