Extracted

• • Target

    40f2eb5bb4ec670ab25e0a610646d347_JaffaCakes118

  • Size

    647KB

  • MD5

    40f2eb5bb4ec670ab25e0a610646d347

  • SHA1

    c72239eb4d39117eb5ef17f73d06803ccc912ebe

  • SHA256

    f2fd3688ebb5844cdf9b104f30b9f3051c830416749543d4ad8a47ab60e51b90

  • SHA512

    2f2aad8169a41ddb8b948fcd279b766abf2750caed32a9110f4352ec03dd11363efb44fbd588465cd781381fa96a576c0e004a3a6a1de4495efccb38eb7c8612

  • SSDEEP

    12288:jQZuO/uo7YNQN2YcKify3iC8ut0i1oQjUZbvFFF/Dr5uiuJ4db:jnuHwQgsiK3AcIXFFf5uiuEb

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2