Extracted

• • Target

    JaffaCakes118_0e946f1d2564a2900e00409cbe07f843

  • Size

    189KB

  • MD5

    0e946f1d2564a2900e00409cbe07f843

  • SHA1

    76cfd969a65fece860f2a11cf4e28c5b12d5914e

  • SHA256

    3f30afab8ca8d10e96b1508c9b2cffa791b229aaf4c78fc709828d5adcf20446

  • SHA512

    6ad84e638d78d1189f22542d6d4b7731506279657e657c65f59cfa9bff2ec560dbccedffa18af5ad4489d390c443c75b9e73233aad9c1c0b096ce92247f13cfb

  • SSDEEP

    3072:Hd8pFuEq0KTLATpJsJKH4uFhgJnMvtH7fkelcxd6zYMaHQaqaOO2YsS8gcbDUC:Hd8pFzq0dWkFLPtH7dlcizYtR/2YsSc

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2