Extracted

• • Target

    5ff50633fb0551da45ebc11b0f40b7dc_JaffaCakes118

  • Size

    324KB

  • MD5

    5ff50633fb0551da45ebc11b0f40b7dc

  • SHA1

    a2b4aa242a3485baf0a16939204221306e5e7ab3

  • SHA256

    b02632a6a15eb3e5d7a690a7e363ae5685071706661da4a763f7b74a7a9f4956

  • SHA512

    44075dfc94674c3cd373e9a2fde386eece7d18eabae0ac70dbd35c6f55694aac25a3eade6a35b67630d7a07d75b64a2251199aa796c93a3a487e339d5c20d66e

  • SSDEEP

    3072:cv5ig0U6OqFsQKf4UkqOZqh/bLByPrHrguP6rPGIi43q:cv+P6rPU4

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2