Extracted

• • Target

    dcc61c5c8a23c4a6fe032db8484f673b_JaffaCakes118

  • Size

    112KB

  • MD5

    dcc61c5c8a23c4a6fe032db8484f673b

  • SHA1

    c961223aac7333bd957ff6b60aa6979ed6a99816

  • SHA256

    f1b72207d36c7d5e909979a0737bf6ac4a9abe7ad72b03eca4b97efbbbc68ee0

  • SHA512

    d245ce9f635f9237b2c9a9a36992f65010191bd812063edf6bfbd5fe59ed6c7a6395c906a172474dda3f1bddeab1b2f9ed5f25571bf2b0675dcab1d05d8ed7f6

  • SSDEEP

    3072:etNuZjGTLPUME4xLxh3kY7O6qwp24oxWu+:et8knE4x4FxI

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2