Extracted

• • Target

    abcf5ce30200f48b2c7c45d9582061b5_JaffaCakes118

  • Size

    539KB

  • MD5

    abcf5ce30200f48b2c7c45d9582061b5

  • SHA1

    ee658cc2faedeb4d5feaf1483474956f43d03d0f

  • SHA256

    6016b82627191e8b4957ad0dcc84ff84375f38cdb7abd0176d1149cfb0007b5c

  • SHA512

    4f2b96fcccb77f3f279952b5a7aa224a82eac0cfbe5195d6fab55e4092695b07e724ac1ffa35662ccc7c3e73a542236216e430151d95c249dda7436ba6a5bbf9

  • SSDEEP

    12288:xHoS493ACIl7vI1kiqHNnyVek/a4QmHNX467pZ3iSnj8tVyHok7IxaGj:xHoIjIbgyLC495467+TAok7gTj

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2