Extracted

• • Target

    63cd4c37ad150d8496621040738cf743_JaffaCakes118

  • Size

    93KB

  • MD5

    63cd4c37ad150d8496621040738cf743

  • SHA1

    23c8f992c8294b15f564fe0e3fcdf219c1c653e4

  • SHA256

    af522edfc4fab44ed7bec9bb0abcb22baf47abbbd173420000c359c413d06c30

  • SHA512

    0165a813d2c3bb835a63ebae24c375ea6778d7b96c8f17b7c0ca6da65f71a3708095812ffb5e41ff623607b43c1e2d34bd8c82588f9a8cfc823a8d6e1929700f

  • SSDEEP

    1536:RIdKSYbzMiYkaPbiAfKhH8PIr0JhZszwX4uU/5FQWSbEkhaL1jzVaOi01kLjfO:RIdtYbzDuPbiAaH8QehZskY5uLbEj1k2

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2