Extracted

• • Target

    15d715e2520a9471dd7309dda8e4bf2e_JaffaCakes118

  • Size

    724KB

  • MD5

    15d715e2520a9471dd7309dda8e4bf2e

  • SHA1

    82985fa29b731d0a6c9c7aab99c34db3e6aa0ec2

  • SHA256

    d90da2707a3babe381fcfc1cdde758969f5c53be39485e25a471587d41c02327

  • SHA512

    959b7833898af629f04843644c73cef1fc99ab17e8cfc16d0833609343463dd1676623afac3375005297dc455e62e4cf0a2621e3ccc5275854f2af3f7c42879c

  • SSDEEP

    12288:rhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a0W0n0FcquQhW:RRmJkcoQricOIQxiZY1ia0Wm0FcquQ8

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2