Extracted

• • Target

    5469ff0c053b132fcb1f0dfea132494d_JaffaCakes118

  • Size

    3.1MB

  • MD5

    5469ff0c053b132fcb1f0dfea132494d

  • SHA1

    3aad2e742ffae23d3b9de66307729e448c1b7ba9

  • SHA256

    7e76b30b7f423b4dec78809c8f5d7f2b91c057baa881652c5ca4c3dc107354f0

  • SHA512

    dda875dc16cb5f0d481d14fe99d2db7a4ff81604274da6f0e4840b7e642502db06571e47a35c21e9165489757d66cd0d332a60f5fb939b07f7a1e69a771f6a24

  • SSDEEP

    6144:9D+MeiiGn/HwiQJaMBxkB50PFn0wcccccccc:UM3iqf4Bxs

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2