Extracted

• • Target

    6e099b508cabb815c17dad807e96024b_JaffaCakes118

  • Size

    370KB

  • MD5

    6e099b508cabb815c17dad807e96024b

  • SHA1

    9ed7c7ab51f0109476601b89e9d1f5ad49ad089f

  • SHA256

    63176672322c9df5e936ef65307a58aa0476e9c782baaa8bdbf44c9a74d8f15b

  • SHA512

    b6d829f497cb85ad4ee8d83d10b8ad31d34f987f774b0a66b13ae2742c04061303ed6bdb36a284f52d141031fbc5e18f34c921db9289415d2ac33cc1d1ddce6a

  • SSDEEP

    6144:c1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59t3HHlrgVZKIT1kPZ7:cjkArEN249AyE/rbaMct4bO2/Vt3HHlF

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2