Extracted

• • Target

    30575afe25275088e7922ca100661737_JaffaCakes118

  • Size

    50KB

  • MD5

    30575afe25275088e7922ca100661737

  • SHA1

    a34bf51d5b7352240fd0305010624ff2fdff79ff

  • SHA256

    72f2004c5d12feb5c0b0748b6e3be3b834bd9b8922ec0549cc5f29e31121b01f

  • SHA512

    0eec9d98eb15c4cf1b2847a72f75264478f1b3549a03b11f8cdee80dc516d301d2b12576da282a85800032b55288a61bfcbd4dd5aafae63a3a41bc081f58be3e

  • SSDEEP

    1536:VVKr3uOrO1U4iU1Ilmt24+1+6GPJPv4rhwh:V8rHrOdiXClOfGhPv4i

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2