Extracted

• • Target

    JaffaCakes118_5e6b5e055ac881014f82014a80c55e5d

  • Size

    105KB

  • MD5

    5e6b5e055ac881014f82014a80c55e5d

  • SHA1

    73f8eb93b06d832f5ca20ae919845f03516a4d76

  • SHA256

    59f0ed2262569d4c04b3cca238e8cb036ede117cf117973035390e417237515c

  • SHA512

    6becdaf41c837e62b71d17723ad205512145c04f98d4e36cdfec3ae805932ae46498f72bd39549b72da4596bbb865644e2180be1cc641dc2a82ecdff09da4376

  • SSDEEP

    1536:yWRTuStQJMpW+yf6Z64uecgWXTdNK//9t8obkKiAXS8Lne7fQ:5RTuSqJMpW+yyM14WDdQ//3jfbfLr

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2