Extracted

• • Target

    b92d85cda480eccf63cdfe56b8a64e3b_JaffaCakes118

  • Size

    95KB

  • MD5

    b92d85cda480eccf63cdfe56b8a64e3b

  • SHA1

    a85aea8e8b0157868943a69d85469492b1e0fda8

  • SHA256

    773d042b2af2ec9e7707854eef50b60fd48cba8f6fcefd3c79fccd424f01272c

  • SHA512

    8cefc3da7b706b2d9e6ce6d6870ade2713ca232753bb2f2a6aa4446fb0ed5445197a44562cf02778f7818d42bcdb07eab4f75d94c9fc0ded1935ed548fbd1a41

  • SSDEEP

    1536:weGJ9f5c7G2G5nr3OxGaXeGFdQToVVC1aCHP+D5y5v26uq7OuzmMXEqBbL1BiT5c:mJ9f5c7G22OxGaXeGFdQT8VC1ecuS9nt

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2