Extracted

• • Target

    JaffaCakes118_680cb651c7ebdfc0a7566d690f722c46

  • Size

    104KB

  • MD5

    680cb651c7ebdfc0a7566d690f722c46

  • SHA1

    97a871044cb5a25e39cabd31ccfd727ac09d7762

  • SHA256

    e2034ec3de9d340c4fe2a5381b6938d67f7d7eda6261504ed491ac78267e10c2

  • SHA512

    21e0ccbbd04b5c8832590be7ecb6daedf83cfc5c00752b39d02905676e1b926d6305b871a10ea1414ae14d8f96fcb4aa0668c27311abcf9b9ce68cda476286d0

  • SSDEEP

    3072:Xo+k6UH6LnX/uCyQ6FainzIQVZy8vX2fiBD:X3k6RLXWC/hinzIQe8Wix

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2