Extracted

• • Target

    5d6368db301de5c858b43599c6be25b0_JaffaCakes118

  • Size

    216KB

  • MD5

    5d6368db301de5c858b43599c6be25b0

  • SHA1

    ed16ae256236f08163c132c95d3b5213af19acfa

  • SHA256

    ef01b3b7a85f9368e2d6e9884dc0868cf9c0d419ab0732753c1c00579785b4c3

  • SHA512

    b0392fd15620b902908708cf5bd1ef2a5b4e619f89166691ab3d770a439fadbbb6c8d1ac655945709146e044c0a56e2aac821e228797c3cfa6989ca7016ee306

  • SSDEEP

    3072:AUFuVSnpZQFg9csV8qqdNd1rcV47GHvpdglyt+zY8ldw:pAEn7cg9c1qqj846B6lw+zY8n

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2