Extracted

• • Target

    b92c5f313160f96245c77a07b2186c63_JaffaCakes118

  • Size

    94KB

  • MD5

    b92c5f313160f96245c77a07b2186c63

  • SHA1

    cd23267bdba6a53a204b81cc3b59d6cce554b5c8

  • SHA256

    5881f6fa203518b39296fb085443599b1b3eb560d678f0c2f9cf03065dfe91c1

  • SHA512

    7e878ff2a65b29c999c1d4b1acf65c9b87f44fb74d67cbdc7cae1beb6e02054af2cd6e68077d988f5023852bfe09344feb2ab0bc46013bebaadc662a6e32f847

  • SSDEEP

    1536:weGJ9f5c7G2G5nr3OxGaXeGFdQToVVC1aCHP+D5y5v2r/ujV7O8jTo/JCSJ3PMJ8:mJ9f5c7G22OxGaXeGFdQT8VC1eZuVO8c

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2