Extracted

• • Target

    8174a96006f2acd6ae72b8e8b1657690_JaffaCakes118

  • Size

    49KB

  • MD5

    8174a96006f2acd6ae72b8e8b1657690

  • SHA1

    df00f51fb1bbbe8a8f0726411cc9650906ee1553

  • SHA256

    7de3054bae0aa73e5ceebca435aea90f62b6a3401b989bb5118bbaf89fb33def

  • SHA512

    5a0486afc6e218583694fddb210c23d2591c038a8c6ee57226eddf1aaf20f16e139f0d617e54900a78061fe59aad88917d1487b83c662738f945bd7c7f9afd7d

  • SSDEEP

    1536:zD5gnDtYxE0moj5O/rDjvmKILPmqV0s2koOqjeN:vaD8EJJDD7jm5Cq

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2