Extracted

• • Target

    ff4f52ac514185111186b2cbfdb307ae_JaffaCakes118

  • Size

    150KB

  • MD5

    ff4f52ac514185111186b2cbfdb307ae

  • SHA1

    a0291e6e56e4491ca9863ef9ad32a480cd8803e0

  • SHA256

    fcaa39d44622d562c9e6bddc61e66b3dc46ca450a00a0ea93951680c3503b333

  • SHA512

    a2d520ed5f464466dead4e33b3b87f0967bf0bd5c3e5166ab69e59f19b92e3b7f9d396c97eb637beacf7b2d47818c9749794bb6e0e5d43a964477402e5da26ed

  • SSDEEP

    3072:QEE5sUIiD71JMSvucfFKiCVl/MzESfw5Zw3aUsjsPRJz:OueFK77m5f+uTskb

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2