Extracted

• • Target

    684d0be9a5caddfdc35d933bdfe15510_JaffaCakes118

  • Size

    179KB

  • MD5

    684d0be9a5caddfdc35d933bdfe15510

  • SHA1

    2c283ccd372facfd97fe2dc3f70a36a7f0cc7c3c

  • SHA256

    a98bda7cf5ea3945e943740d8afb5329511d83c71aed5e95262c6e1c7581790a

  • SHA512

    7018d151c8e6c8ab286adda37b5dd8572b65a957a0402d3588d359fe3ae3d0b752ec310318db688da0fa6a94b4592c3fdd69935e33dae03b6007d0b9672af19a

  • SSDEEP

    3072:G0AQvI6GHikMUK3/5192UtpohRE0TmjraDxmPzrc77OWw8x8c:O7CPx72hRyHQxIc769/c

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2