Extracted

• • Target

    5c23c609fee1f330cd584285ab2cdaf6_JaffaCakes118

  • Size

    163KB

  • MD5

    5c23c609fee1f330cd584285ab2cdaf6

  • SHA1

    4e80df6d24ae1dc86994347fe6ddcbcb0648f5b6

  • SHA256

    869d5baacdc7a8a57f8702c7904c4b3fc9bd90af70ff08845b83d2b3ff848e40

  • SHA512

    86bc3d0cfe156723ac3c313c11610871313ae65529268c6e8bc382ce494490f33e63fc48139a602c0eb2402b9f4cdff24722116666a166a4c17d410b0bd7812b

  • SSDEEP

    3072:DzgnMZMAht0Nht4pr9NJWqrkuBIH4qx+9gnUhPSNNfX+v+EBEhpa:wCMOpLIqNBgfCuOv+Ev

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2