Extracted

• • Target

    JaffaCakes118_65707c3a420e0caac14e48a8353c2d70

  • Size

    635KB

  • MD5

    65707c3a420e0caac14e48a8353c2d70

  • SHA1

    9614bfe12d334e260da4e2d00f2185f34826fb46

  • SHA256

    fbd0ac1d27ac37fad26a02989094f3d3351a2594dcef85180fba37e686df6dc7

  • SHA512

    554c4d30824abd186811429a5c1ce90e219805792e1eb07c7b66255c6a24c91329c61bb28b8d7f812a5136f812f91e85165f7d51d96f0a152942f1527fe1d3db

  • SSDEEP

    12288:mEYdefCHe8N5avZIVEax7JhYKN0Aw6T0UkA5mfLif:mEYcfC+8N5JVRJh5y20mmfLE

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2