Extracted

• • Target

    JaffaCakes118_033c120e6e4b4bdbfc1734ed010647e9

  • Size

    964KB

  • MD5

    033c120e6e4b4bdbfc1734ed010647e9

  • SHA1

    f9b176201ffeb471595b375db904bd9bd0a40fe5

  • SHA256

    89834e6ed97c7926c9efefbb4775f9df52832e0cc0aabeaa64b851b946a2d5e8

  • SHA512

    c2d66524d22ea15b9894781ef61e410473ae94bf869db48b1a4a5ce8bc007c2066126beee778ca1c1046762ab407b12424d956b6ac8a1bbe93689ee995cbe4fe

  • SSDEEP

    24576:idlCrilf4RrNPzkDmbvk7+c/GcIdvnacvcMK+W9mck59b:eC5f79m75Idvacvcj+WgB59b

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2