Extracted

• • Target

    73c20f21456d3965d631bc0fb96f87ea_JaffaCakes118

  • Size

    260KB

  • MD5

    73c20f21456d3965d631bc0fb96f87ea

  • SHA1

    16e304622146129b54312f34fca2edabc1176043

  • SHA256

    7afe5b37672d20bcdee16ff41c6a4e3610e3fd323a4711060b958c67c300eae3

  • SHA512

    ec837c49bf5d253eac613114aa50100ece987e7fa099474279bb82fb2864ee26e00d4c5fa512af365c9e0dd07eba0438c43f60477527992ea1dd95621dc14988

  • SSDEEP

    3072:a0OXaDyrCdrO+SZUfaiaFqpCJ2tAkj0wK5HWahWvHzC+qz33CvHvzmCv4rTXkrSu:Xvd6/ZUSi1+2tAW2WI+qzIA+lZ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2