Extracted

• • Target

    672b2e58520b4946f72512508e5599d6_JaffaCakes118

  • Size

    99KB

  • MD5

    672b2e58520b4946f72512508e5599d6

  • SHA1

    a0a226321964a7e8643b5e9c657726d09b1ee6b2

  • SHA256

    7051d803765c0c7afcf8231c4245dbba8e337627ee543e7e84c3e904e4404dbd

  • SHA512

    61889552ab714db2e086688b03b194408509c6b2d75955d1b8c11a531fd218e569e0129cbfc5e607e4287213b2290ef1bcdfabc7218f78400e6e1066de06e7d4

  • SSDEEP

    3072:0vhbY9Pvzfd+AZ170oOA1oNA9kH4i2L1INsngy:eY9Pjd+u1LRiekH471E

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2