Extracted

• • Target

    JaffaCakes118_48612e1ed01ae1104a7a6f0bb33cef7b

  • Size

    73KB

  • MD5

    48612e1ed01ae1104a7a6f0bb33cef7b

  • SHA1

    1f2e888a65d8703325aadbec511b9ff7d4ad950a

  • SHA256

    a9327ceaa13923fee12a3b076a04e919f9a77d01ea9a557ce097d9f05ef3943b

  • SHA512

    ec9f3cb356af6f7d2c9a0a8f3e0eaf034f7e094f7d1b9f59d0c651e0f947a2ebcae70a84fd20bb8b5778b2a6e5c75f7dabf258570b2e00a3b634c0309c4cc732

  • SSDEEP

    1536:IqU/BXSo0qb51kKdo0kFL6oHhf2CukAv4HA0QvY2NkLAyc+/MuH/i8sS13lk6g:IqU/Bibqb5GKG0kV6WuCVFH36Y0kLAy+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2