Extracted

• • Target

    JaffaCakes118_6e7cc88bcd853bdc367674bc9533db48

  • Size

    944KB

  • MD5

    6e7cc88bcd853bdc367674bc9533db48

  • SHA1

    e1328a4a2ec375991a81a28dd00404c670748beb

  • SHA256

    b3bfc99ee408e38c527d10dabc5123015b5d51cd3c8faed7339f74dd17251a41

  • SHA512

    83df8ce5c5d832314d31ffde3b8d6a9a4e9a63158a7a2d78be9b345bf6b2c9c9851daf0d41ab1f244add5baa5df451eb90d70c2e70a7f809d99d7e4db3ae7506

  • SSDEEP

    24576:1RmJkcoQricOIQxiZY1iaTyMt2oonDfbrlY:aJZoQrbTFZY1iaTyMtZonDfu

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2