Extracted

• • Target

    974856747485487c8d4eaeb9d9e6ae61_JaffaCakes118

  • Size

    204KB

  • MD5

    974856747485487c8d4eaeb9d9e6ae61

  • SHA1

    afc3a7d278037d5af3225ea76ba614d79532ceff

  • SHA256

    f2527f13af8583daaca036ddfb8f4f6715b8b086a8a4b35fa215b501261b1e56

  • SHA512

    285779f7f3622dd3e41726024039fb71f001884b9863cc87dbfdd70939f4bcdf1efa46e89eab2c294a23722b64af9b5f80843240940264a802b0d515139c6bd8

  • SSDEEP

    6144:mYq/crJ+4eX8JpRE6HEPWZwjAZa+3+AVOEMyN:mbkrJ+4eMusEPWDZTMyN

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2