Extracted

• • Target

    6e542c4e52c34e9f0d3e5cf429efe791_JaffaCakes118

  • Size

    108KB

  • MD5

    6e542c4e52c34e9f0d3e5cf429efe791

  • SHA1

    d8383373ef8d9a73506274d9d7207c0e4708f648

  • SHA256

    bb562d8452956a42c40a7c9c35d6279b6ecafcd1a20f09e97c335ac071742935

  • SHA512

    502cda41b7b08c5b672f6a201fdbd589101529f7eddef7c401846581296e275da3ea9db60935f770b8e829c1580c9b77e07b937a75e8c25accfbefdc74117999

  • SSDEEP

    3072:doWMODtBqfTOHMgAqm5+5blKy96f2PZmis:dDD7rHMgNmM5bAPf2Y

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2