Extracted

• • Target

    JaffaCakes118_6d8926898f239ca5bb3314a9bcc4113b

  • Size

    230KB

  • MD5

    6d8926898f239ca5bb3314a9bcc4113b

  • SHA1

    2b7150a480ef30e2ed0eb43039cf87b30b54c4e6

  • SHA256

    0f003fdf870c987e3a15a1761b00145f5259136cb7b741714a3422644c2c2de1

  • SHA512

    34eefaea972406f0aedad8c6886a3503d6eeac2905149be187117e11753f3a205f3dc1c8e56ad290c1618b5ea0cfbb8eae08169e1c1a63052372e56aec06b203

  • SSDEEP

    3072:nLJli69CXY8Q0Z5LReCnAKKvM/gEG8/r4gwL/ea+BaZ2odFadrKj3OJce:LJlnsLReCn3KvM4EGE6L/e1acodFYUO5

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2