Extracted

• • Target

    JaffaCakes118_19b55b49eb63d0d65a0f80145f9eaadc

  • Size

    500KB

  • MD5

    19b55b49eb63d0d65a0f80145f9eaadc

  • SHA1

    69d0944d5730a1e4c6ba462bea7159da84b603ed

  • SHA256

    089e405fae3c6747142d867983fe57587826fbc727ea23e452db1a1a3a17f7f7

  • SHA512

    5e09397606a8e0ade6608bf0f440a2e2a1aa70d946b539458f250d64c21065af6c03ed0fb248fd4266d306d08fdd9b2c60170b526bec08632aaeb39942252d1f

  • SSDEEP

    12288:kFumuLM+DqWaSMB9yVtKAyEHohkyNA87Nhg:kFaY+DqWaSMB9ySAyhkyDRO

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2