Extracted

• • Target

    2f65c7b7898bd9bb4bf161e7fc08c618_JaffaCakes118

  • Size

    224KB

  • MD5

    2f65c7b7898bd9bb4bf161e7fc08c618

  • SHA1

    f4b1ef2dcb0fb862b47d8dcda20ce8e657a74124

  • SHA256

    6ecc8aab4f6c3284a4b618836b96b470f2e6795f5eabfcfa68ec12db1911e425

  • SHA512

    697d299ebe5267a8bc262435cb6807c17057060ba15716b5234228bc816e0057b1ab56d2d378487dd51ac28a922cbc2f8ac3803d0b2cc14fb8dbbaae63ff9bf7

  • SSDEEP

    6144:kAeIifU8j6EwPPSbGsl/yJLo0ZudsdRwW5K+Aw7Qoj+:kRFj6NPUl/YE0ZudsdRh5K+Hbj+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2