Extracted

• • Target

    915934cf49d064582bfded5e2759bccc_JaffaCakes118

  • Size

    96KB

  • MD5

    915934cf49d064582bfded5e2759bccc

  • SHA1

    8cc0c1565dabe23e68d0a077d7d4c7b85a266e72

  • SHA256

    4aad75ed803d96e03beca18b288f064f23faae17ae3e812122b41b4eff5686bc

  • SHA512

    9d7aa1641f0e91a5f0c811d53ae9646d44268c88c3751bda48b6084782a145e47169cbbc71823c8c685ecad3bd9235759c044444d9903a8fe1a3a8ff80c1cc2a

  • SSDEEP

    1536:q07StElwoTf/1p4hWNdISBpStXN4I/2niUv5NgbKXyUMUGMIyef2:byEaoTf/1OMLISBgtqiURNAKi0eO

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2