Extracted

• • Target

    JaffaCakes118_027c993ac8e604bc9450445c5954dfd7

  • Size

    84KB

  • MD5

    027c993ac8e604bc9450445c5954dfd7

  • SHA1

    c2eb55c7459507eb2366344b0c016e9fc9cfb2b3

  • SHA256

    e216d13c22ac5e2cbc309779c460f2dbf19ff916946d9c8d65506bf5bc6ad355

  • SHA512

    d2a664f06826c9d7da9495dd6444bf5e828a8b6ff4b9d33d271b6179c8ff69c2bfa61cb72d515c730f8ccca934ea1333fb785b05f3d7acad5c6860bdc488a734

  • SSDEEP

    1536:Ss/psfKLveiUj+UgapkUbl+Wf1liDzssei13OzJbYhXbwJMTy:r/cyelTpkUbQWHyiiFUSTy

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2