Extracted

• • Target

    c1aca19f6cd902db13b52317e6301463_JaffaCakes118

  • Size

    188KB

  • MD5

    c1aca19f6cd902db13b52317e6301463

  • SHA1

    4eefb8b392f21f286c178e4ef94fa1f584c67281

  • SHA256

    78780e9cc0a1a6c30db708f349251dcac3226d96cddd61e3ed45b6160a35c342

  • SHA512

    861b4febceb86a5416f680aab6941e1b11589583ccbfefa4e8f2e240f784dd10f9e889f3578ef7212ea8e83ecde1c1ab3da2189cc33eb8d16b68dd2e478fb498

  • SSDEEP

    3072:7o9MODtBqfTxurk4i9EcJ13UztSTUBs5DWhXyr0vw3mt:7kD7E54iALBs2ca

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2