Extracted

• • Target

    be86d446ee18563595249dd93a50c204_JaffaCakes118

  • Size

    75KB

  • MD5

    be86d446ee18563595249dd93a50c204

  • SHA1

    743ae095cb8b3bd1844af5f8557b076aeaf3c5ae

  • SHA256

    0bd08aca396edf3445c79d48bf514e7d9dda51ea2dae93ffba6b189c36846b65

  • SHA512

    85b5930ea1e122f94562f59d1203d75236493a94820fb313beb7ff6d5b21ba4d8b33793147feea25c7fbb8a47caa0c465fc5eb6324aa00b529a1829ac1180408

  • SSDEEP

    1536:Cv1vGQE2bM83T/y+EsTCT9lt2QL++kGGt9Bav8UlkDqy70gOFmcAAjmbH7:CtVE2bF3MsmT9v2QLIHQv8UlkDqyg9V+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2