Extracted

• • Target

    955be94e8ef438b9bb86eed8faefa0c5_JaffaCakes118

  • Size

    90KB

  • MD5

    955be94e8ef438b9bb86eed8faefa0c5

  • SHA1

    7157fc0e25bd18a0c652036fb3cdf6409a84467b

  • SHA256

    9db0163883a555a809da34264e9b8e70f5d9a974d31e237af1874841c6e929f3

  • SHA512

    af609bb1fe4fa3b9db0e7ab06eb4bc5a6b5c0e659766bb5f80de02e399971370541afd5030b3d97df4e9517109ac4721cf084e40f6b08ad97a0ec931ac466ffb

  • SSDEEP

    1536:2rhU7XNDz5hwv4a7c6brQ+jeaKkZveh4o3NkmYVXyX2+cCCNZpl:2y7dX5hwwEcOQwsEWW06P7N9

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2