Extracted

• • Target

    c3cdde3584516d89851440cebdd655ee_JaffaCakes118

  • Size

    340KB

  • MD5

    c3cdde3584516d89851440cebdd655ee

  • SHA1

    f045ad188f27cb821e554ee7ff05bb5a7e79e0d1

  • SHA256

    bdfc0d91fb3d88e0d7719d7da22beb5cb53807910d21474239550c6fd29675dd

  • SHA512

    8c90d48d6297d109e2a286a312b2caaaf2d6e59590e8c52b0a6632846500af49f40126bd7ebd8662418a787aa6348a07567012a1cd02d8ba17da6202e82009aa

  • SSDEEP

    1536:CAQA36S1au3I9IctmOjBCz1OUiLyU/ZJH2XOYNeSbHq+9ahADGtoBkzzRSz:96SMukjBCz1HiLt/ZJ0X8SbHqqJk34z

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2