Extracted

• • Target

    39f745ab873caf4c196a1bbc96ac973f_JaffaCakes118

  • Size

    228KB

  • MD5

    39f745ab873caf4c196a1bbc96ac973f

  • SHA1

    7616413b64c1ef531ca512e9e9d597735911b391

  • SHA256

    e4dc6d8626f596c20855afe0bd66b7c64c07ffe774ecf667f4f4753dcd76c830

  • SHA512

    4edbbecd8d283b4b0810ce977f239da2ae03097be2455c8acd420d21ed43447895368fad81a6c558b709b2499d29369b3e2284e74e4c15ff3cbe9904df1e1c1b

  • SSDEEP

    3072:++0KfLf6560tW+0H9w5hejL/iIaw0bbSudCo5//gyx8XfpmKhSP8TjJEjYC6wta+:7fLS5c9hjpynooxgyx8XxdEY1WFWX5Hi

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2