Extracted

• • Target

    518d5affcbd0afcb7238ebf66c1fc73d_JaffaCakes118

  • Size

    81KB

  • MD5

    518d5affcbd0afcb7238ebf66c1fc73d

  • SHA1

    6884034fe96f76ace8504a8c899e94794af33693

  • SHA256

    6f4637310e290c39a9d256cc54dbb06bb714331b25b63fb95c35ae0663159936

  • SHA512

    64f69c3338528ee25ac3e773cb97e313133cf597efa465cddac50de7e4a6a94f4726a234f54d328f15a287218d584a2517e7975e8a93850644a248c5f1dce109

  • SSDEEP

    1536:obMCOBkTUeC7sv7Rlc3sQyQNiiYzrTJgKPnUlmVhAadQ68lVHNH4vvbt:oxOaWgdlc3sQJNi9TJgKPUMd18ntkDt

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2