Extracted

• • Target

    502809355ff063d0faa34edcf6a29924_JaffaCakes118

  • Size

    244KB

  • MD5

    502809355ff063d0faa34edcf6a29924

  • SHA1

    249a4d771d7fac31cc6d9f84b4eb781159b77202

  • SHA256

    abee552447a9f6e82cc188f470ad39411f836cfe7db9ca16d9507a2aae31b1e0

  • SHA512

    05c2e04a0173a1c28ce78cf645c1debc833244ea6fd7ef2faf025937053eb5cfd0a679f1287a0d9d661f0cc75cfc3bb0b74077445756340cbef831b4f1f376d6

  • SSDEEP

    3072:eU4jfiQD0JI7/Fpuni41hdskPGvv45nG0N6C6SnZ1BZeI5n:o7v45G0N6CVZ1BcI5

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2