Extracted

• • Target

    555c25b7e2af2d75ebdab19d83d0e8cf_JaffaCakes118

  • Size

    220KB

  • MD5

    555c25b7e2af2d75ebdab19d83d0e8cf

  • SHA1

    7d9e1c8b1954c78f7f50c214c1a38aff825a17ea

  • SHA256

    9c49a2223937a6bbc79033f7cb20782ded4a5694d6b096eb35e5742a028eacc1

  • SHA512

    383a16bc328f18264a32791b81bccb035d0814f3f17945b64afdc0d59f14087b02ec8c1579a7d3692726b8cd77841f39f03ed9e43d6d1ee225aa836fe345ed41

  • SSDEEP

    6144:86/2XhA3QPCwzUFShv+C+e+GNLBRRArd6905XcA9mV:l/2XigqNFev7+0N1RqkGcGmV

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2