Extracted

• • Target

    609df379359175dbbeef3735204342dd_JaffaCakes118

  • Size

    1.5MB

  • MD5

    609df379359175dbbeef3735204342dd

  • SHA1

    5f74b5a3bd063d9d2602c823160adc57e6760464

  • SHA256

    c4a5882cf2286a8b2d552f212c0cc88b49300829962fa2ac750cba20ad7fa37a

  • SHA512

    ef99f34cbc93589abb24b096391299e40047a18758b614e889d7dea0130625209cb2a2895ab21576f6b8b41c8a750e9cdddca24b4007968ffec4a4023e8d45fd

  • SSDEEP

    3072:uem/7Now1RD4rn83ubRXlBCDHt+AIh2cdTUBx5lpcHqAsis7OBpkHEmWvyRL99fa:uHXGhQ/7G7DqQU/X3+fdxUC7D

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2