Extracted

• • Target

    3d42e2409d81ab8913b6f1ff27d5e770_JaffaCakes118

  • Size

    404KB

  • MD5

    3d42e2409d81ab8913b6f1ff27d5e770

  • SHA1

    bf3585294138a24b3d0ba410baf0450d72ca7d31

  • SHA256

    6423d81190d104e49e0dd6b286fffbc2ce9c0d71337a60f4001c968f6f0c6ab7

  • SHA512

    2e5004b479ddf35016fb8c296de19c72a5b5f763ec3178c0f52aff645d40c9001698de04b4ab96be77a372b90ecf82214de404f3d4c4fe50e6700ddf19a03dfc

  • SSDEEP

    6144:vem6d0yjom+dN2F4mulKtSw+e6RtNkfNpQW777VUkjdkf3xrtVwZ4LVs7i6NPW:veCyjfeBlKt/z6ReLddUkshrDa4LVZ64

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2