Extracted

• • Target

    4c22b4b78f95b0cbb54b25872ec9bd85_JaffaCakes118

  • Size

    340KB

  • MD5

    4c22b4b78f95b0cbb54b25872ec9bd85

  • SHA1

    3eec08e106efd0be7a027d4866c76f423ef39d72

  • SHA256

    baf96c3dd1a042de4c16fff10491135b64287549cbdacd14e4b8b0a40789b4c1

  • SHA512

    b3dabdc14a77f6804e07b410722a0cfa6853d1684071ec317340a794429c18da517d6a7d17ac13ece36a4275da79904a982909a5205133cc8d71012efc5b0b37

  • SSDEEP

    6144:LwQKve6BF/OZQpFPSKLqL75lww45Y6/VPsxY/UJuMCI5odvM3jM65klmb:UQKvzF/Oyv1+P49/S6/LMC+qvMWi

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2