Extracted

• • Target

    JaffaCakes118_df534c0e8982a498b681936a3a13e388

  • Size

    161KB

  • MD5

    df534c0e8982a498b681936a3a13e388

  • SHA1

    8065f726379c9243fbc06c3223132da1224a6e26

  • SHA256

    12c18964bcd5e3514ccd91c06a7dcc8702cd83b29e353a5f5f112b7deb38fe12

  • SHA512

    524ccc770afa315a654d51cd251ac4db76aaab68f6bec82f2ba03dba7e31c6782c6b324969305b986de6f3711e741c4f5eaaee13e0f8395bb05c0550fe59bbaa

  • SSDEEP

    3072:M/Fg/aDgAg446PAfkTT7FtSx7FLdpTHuxDpVt6lwQKklHYrJoUV:ygbf65bcRpOjclw/ksJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2