Extracted

• • Target

    5a86e50772560aa88dcbad3ee94f1c13_JaffaCakes118

  • Size

    645KB

  • MD5

    5a86e50772560aa88dcbad3ee94f1c13

  • SHA1

    8936765c54d5bae4337b48a13c8b6e17d95bb2b3

  • SHA256

    044aa542a343314306a87d462c548b9dcac413df9248f80193c1f4fadf45e438

  • SHA512

    b4dad1f56bca62cc88eaf5da286a7faec04160e9117e811d364245c676af3b29023221d6c64324db5b16def5f00e4e0f0c1b7567a079644a5eaacf13301a8781

  • SSDEEP

    12288:6QZuOWo7YNQN2YcKify3iC8ut0i1oQjUZbvFFF/Dr5uiuW:6nMwQgsiK3AcIXFFf5uiuW

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2