Extracted

• • Target

    76187fe8eca802abf046be517add1e53_JaffaCakes118

  • Size

    91KB

  • MD5

    76187fe8eca802abf046be517add1e53

  • SHA1

    0739440a671c1eeed33c64944e2d07ce93d49da7

  • SHA256

    2d7157fb767670ca7ec64558a23afac6f19336993c79d5cdabfc482d5d899771

  • SHA512

    f1630985ae3fcfbc23a3a0d206ec177cf4ece9e8bfdd8a854f120def2eeec1abfccf75071aabe48d3d757a71692bca88a311bc78f78a5bb1fbfcc7b8b1dacf27

  • SSDEEP

    1536:lG2EnTramCVTJ10eZyhVuk7vVkXOcyfwICEC0whqhBH5L9CkPI+:lynvBCVTJ10em08O+cWzCKwWHV9++

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2