Extracted

• • Target

    c553c6254ddc31aad3b02ff04ee9dce9_JaffaCakes118

  • Size

    301KB

  • MD5

    c553c6254ddc31aad3b02ff04ee9dce9

  • SHA1

    57ecb4bf03854164e3887dffafded843fefe96e3

  • SHA256

    bd22d7a8343e1458fb83631442e09ad733945fc964f0e84e5338356f2c9200dc

  • SHA512

    18fb0c22a17da23dc2f43c6c41faa5807ba84362709200f318ce5714d0868765400dc4f8bb70e79f0f1a65fc6c5da1c44c197704eaeda1a5416410333818fd5e

  • SSDEEP

    6144:Qa4mFBMrCEckihB3RxSFxqFznnaetR0hdHDQv73pV+so:QahFBICn733gQzx/0hdHkv7c

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2