Extracted

• • Target

    884a43c003ba1f3af9569e2dc074c473_JaffaCakes118

  • Size

    107KB

  • MD5

    884a43c003ba1f3af9569e2dc074c473

  • SHA1

    938563cee0fe300a0400ed9c088e8dfea8d3ff88

  • SHA256

    bda74dd91bbf875a1c40bc3d36e807f28adb718d3b508c93445b819bf9b9e649

  • SHA512

    e430525939ddbf2343f04b37c00924bf8162a416e9f2c2bb3c86da5ff4ac4fa7df65b334125a521c971bfba9d42896dcbc17cf1351c619577307d09fc4e733b4

  • SSDEEP

    3072:4aFB4+mOMZb76zAuvjlj97E3FuJLr3zvXTj3/3ErQj3NhOB+ZNXm95ZW3X313jzN:LmOMZb76zAuvjlj97E3FuJLr3zvXTj3j

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2