Extracted

• • Target

    d5d1d52ae2c5479eb5dded21656ed24b_JaffaCakes118

  • Size

    117KB

  • MD5

    d5d1d52ae2c5479eb5dded21656ed24b

  • SHA1

    87201fc20230954670141ce7853c1e6c9bb92003

  • SHA256

    bdc2b55659b8b89d1bb54d80b64d85527fb67382a4b8fc58852bb3513605822c

  • SHA512

    f85b4c35853a1d8753f0e6805886229c00815779c8b082e1ab3496dcadf9c7759a6450c3d0f1548f14acc78e339b78a5ea570e9cdbefb4f8d226718d312d797a

  • SSDEEP

    1536:HReaCi4LtqlqHrwr2zST+J5Zme8pDYJ0TFsII2jENH6K0SrXkEKcrXk:HReaCi4JMr4ST+odJDsIIKo6K0Sm0k

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2