Extracted

• • Target

    bc7cd54ab4e6e5fdfc7644da9c80e00a_JaffaCakes118

  • Size

    92KB

  • MD5

    bc7cd54ab4e6e5fdfc7644da9c80e00a

  • SHA1

    31b71caf630e8707773f64a82080346c14628cba

  • SHA256

    1ae2824e23518bacf52ad806a944f2b71752c8f9bb00afc8641d9462878aa515

  • SHA512

    f9343124136cb16b7524867f47190b8a1f96bb6bf573949d93f8afb6ff5dad55ff4ba8679d634f9685c99e0a664440d0cddf59ef41769685a7afe276e96b89f8

  • SSDEEP

    1536:CHpaCKKadjWvIX2vkG67bBFJRD8/WZRYaNdDuwJ8QZg6IOm7o6LgHmU6VqkJ:qaCKPWgjnJ84Ndr8QKdo6LJU0J

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2