Extracted

• • Target

    719fc69a8f4ef822cdef72e74e7abfd1_JaffaCakes118

  • Size

    437KB

  • MD5

    719fc69a8f4ef822cdef72e74e7abfd1

  • SHA1

    950e086289b8897d31dfeddfef0396adf9f24d2f

  • SHA256

    310610ea4ca54ccc31198c7abc029194a220805d7aace4bfc347f9da6e71de81

  • SHA512

    1f6df574ae72926757fbab26acc3d4e4c33298002b00cc417305eb33ff672f2ace8b7e1ecefb64e83bf9e9314b8e19cb57fcaeffc710bb5be428f0c46b72adc5

  • SSDEEP

    6144:tSRbCBasF5wyx9MyVOX7HBecbeu0iqNsgmovzmzKM5MN0E9JhWBgUd6Ys:tSReBh1xkAce2qNluW9JOXk

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2