Extracted

• • Target

    eed37789aec426fecc0be5bf52411ec0_JaffaCakes118

  • Size

    126KB

  • MD5

    eed37789aec426fecc0be5bf52411ec0

  • SHA1

    cda7f4b5d3528a8465a5581f44749d4ba8cc3134

  • SHA256

    b88fdb60aa31431fae969560b73e85c549a4fee0596d433ffc2623ce37a1a860

  • SHA512

    93104f7c42f1c2dd8c8c4144b24c8dce0361fe55e6d47b40de9035fcd428bb0c42c67b17a5fd82e288b2744fdcb4fb3f50133053abc882eb98a789dd985618f5

  • SSDEEP

    3072:MsoINdRejOqVSl2lwWLpcfYLEoS8Pua/RM8imipe:VXdR2OqVSl8wWWQLJvWai8d

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2