Extracted

• • Target

    bba9f9b5323986849596e2a63509f233_JaffaCakes118

  • Size

    106KB

  • MD5

    bba9f9b5323986849596e2a63509f233

  • SHA1

    2b5af5e575b68a0631692ebeea11a150eaff6bb2

  • SHA256

    969e50237f0c4177abf5e8266c465e7a90e8962fbb7a800c32d59013fd4d6bc0

  • SHA512

    a4995e9b50711f07c668c830bd99801006bc536850e0e8d01b8537a01574cb269138f2ac3d5c34f8ea479f5a0e58713e0603fcabcd706bcef0080647681be411

  • SSDEEP

    3072:E9DbikDfrswfynnZyOlQ+fq/75GinKIWiMysngr:ERnL6EOZDinKI4yz

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2