Extracted

• • Target

    a1e69c9154c43e19eb2a10ac050a10b5_JaffaCakes118

  • Size

    165KB

  • MD5

    a1e69c9154c43e19eb2a10ac050a10b5

  • SHA1

    381a2ace8d4e5a59e5a631bfe1df71bfb3c00c84

  • SHA256

    d0554d641298a47d73c86b0f90c1769deb4617187b16eacb1619ba3f67a7819d

  • SHA512

    302f718ee38de979d4b0ac4d9b2c9244bae5b8b42c9b969a9e621b736bfdbb91e7c42e7f0f3e52dcd9ac82e2f19062d2f9535ea92a96bdaa7687d6ed52514e61

  • SSDEEP

    3072:BL/aHtA9seHD9wLWMYFlYU3Hps/s/hzRDmPf7jCgR65zjLxl+vKcjmJl27TYu:BDa29sRUHps+bDmrjRWQK5l2fYu

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2