Extracted

• • Target

    5ce182d2ef3be3aee621362e88b90cf6_JaffaCakes118

  • Size

    70KB

  • MD5

    5ce182d2ef3be3aee621362e88b90cf6

  • SHA1

    c40cd054aca56a807004b0cfee24fa90200c0d0d

  • SHA256

    7fbfa39b78add7cc01bd28fffb98f5ba18cbc428e2f75a95caf2d6577e945029

  • SHA512

    dfae11036a40e36f372eb097eb3798f11e09b28bc45d41056d9eeb9fa97ec6dcb59de52e5d9ab5585d60cfccfbdc0d3da6acc6d306da01f53df77f95b170572d

  • SSDEEP

    1536:jEoPFC7UkWipZb1OYCGJcGLvXlo342gKmEEbGoa:xUIk/POvGJbo34TKqM

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2