Extracted

• • Target

    528bc0869a28d3040c8032459698b12e_JaffaCakes118

  • Size

    250KB

  • MD5

    528bc0869a28d3040c8032459698b12e

  • SHA1

    7eee273cf12b17ea80c8bb76f3be3f456a23f51d

  • SHA256

    fdab0a31ff67dffb842e2804a98f382aa60fcf8db5b7f405b0bcf2983175c53f

  • SHA512

    2aa442406bd8ab8ed1787b778543bbe2a7befedf4128af4b58e063721c887c6bc94e1148ebb734a78c638bf9828cb3f4e9649710a08f25884197c68748afaacd

  • SSDEEP

    6144:tCNGbnw4LTMcG9Tdajy5iJ9ZzoUaS3BB06Alwc:tCNQPHBmajy5sz06Al

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2