Extracted

• • Target

    7a5c0ea05331990478531c216bf8fb48_JaffaCakes118

  • Size

    304KB

  • MD5

    7a5c0ea05331990478531c216bf8fb48

  • SHA1

    bf98160c1683a5968ab9393a0252a981b34f520e

  • SHA256

    b33a2b05a2577a1aecaea2ed17d054d614aa60796f2ecda3ba3fd16f30f1ecc8

  • SHA512

    ccdf8de823c25c4c277ef1d055e09ae9f2c527bb3e3c63829259040460800e56ff7533846273aec3f6119309c2b099d435dfdf4cfb0116217fd0815e3ff6640b

  • SSDEEP

    6144:n0KVE4LCMsOdjyGti8dK8aJyOJLtGkQ3FNs:n0CEGCzayGPPaJlJLtX8FNs

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2