Extracted

• • Target

    bce7b5687b36b7c35764607777f1e422_JaffaCakes118

  • Size

    96KB

  • MD5

    bce7b5687b36b7c35764607777f1e422

  • SHA1

    892b95d44508d28a2a848a7a3739cf28b2d108b0

  • SHA256

    49c26e68251abe59804330e92802c8f88e320f0faef230f2a0a05161e31b2340

  • SHA512

    72c6c9927010afc0889967bbe98292104129cbd16ba27eb6896d51201e3cd107fd469243bb66dbf6a1fcaa259978a97e0cfc3381737ca6feae43907761199d32

  • SSDEEP

    1536:T2nk5Ql124DsfuMuG3bLCYP6eSVKmP+SW3+Bs9K7Hreyiye0PnD:T2nk5QBsmMd3bLCBKa+N+BcK7vip0PnD

  Score

  10^/10

  xtremeratdiscoveryevasionpersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies firewall policy service

    evasion

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2