Extracted

• • Target

    3aa8d8eb5f79aae5b1c7e4e215913178_JaffaCakes118

  • Size

    95KB

  • MD5

    3aa8d8eb5f79aae5b1c7e4e215913178

  • SHA1

    3a47f629d4e41ca7b1674ef25031e4dfe4a927fd

  • SHA256

    f221cde9e2ef3b5e5d72accec6f2ea46676fea68058077b366eaff22e3d01b2b

  • SHA512

    a71d52c5219341d33829772b65fde65cef66001b9cb6587a97a0775ebabb1d47a2d2947cf1cb253ad943be7fadcceaac88da896127251d0785d0f6aa70f5e3a9

  • SSDEEP

    1536:HP6WyHRjb4S1tCoIFD/Ffi8tLoWSJdWMwDTFa:v+HIbfxtiJdTwDTc

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2