Extracted

• • Target

    3aa52641623763e5655610075e80cc4b_JaffaCakes118

  • Size

    200KB

  • MD5

    3aa52641623763e5655610075e80cc4b

  • SHA1

    63f87c7df7e46cf776dcc4a6bfa4fb4da76979b6

  • SHA256

    f669e27576c8b8453ad3d26920b4d9e120db773d27e4f067373c0277153ad3e1

  • SHA512

    99b94fcae686edb3bfb2f7d815c703c143808dd578ee01df6fe0006c32dce565bb5c43a88c70475058906dc45d23ec20f3136b8b68e36a040f7e8399eddd4150

  • SSDEEP

    6144:VYt+57OdThwus5emGSMFliMI/V6x585YtB:m+57zemIl+9Vm7

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2