Extracted

• • Target

    9723ba30aa8e15405aebba2058f06707_JaffaCakes118

  • Size

    68KB

  • MD5

    9723ba30aa8e15405aebba2058f06707

  • SHA1

    8bfa78bbc87d6e67e6cf16bb3cf3300823741e62

  • SHA256

    4d9bce4b89a2ade61ea7f46c1ddb43b06a4984c4d7408b1a6e8d65e5301d8dc4

  • SHA512

    e73038e7f9be7871eb47fcdabbfbde68e3cc3c587783e20071f83c6d885d31abdc2bfbc83f1c256b082ef1ad05c7c6ccebabc7a20a2929c6d9a6cb28a7fe4fac

  • SSDEEP

    1536:Cx6dWqGaSnZQAP42sOLhazjCOGNm0Oi6/et:CE8aSnZ17smhazxbc6/e

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2