Extracted

• • Target

    JaffaCakes118_243454c6a2775a2415011b97598ed4d2

  • Size

    105KB

  • MD5

    243454c6a2775a2415011b97598ed4d2

  • SHA1

    29659d159499ca93f3c75a640fa9b89cd46fdd7d

  • SHA256

    61e523ca922591d4460fb3c63ec4627583bbd74e2d5b37172ce762347a946ebe

  • SHA512

    05340d150711a8c49fd259f7c0e0a1ee33cacd6839642842e482f0e3fcdcf44eeec66b7b33131ab71e576b5f744dc0fdb64d3bda4e419fb2ceb65350a1a64264

  • SSDEEP

    1536:Ss/psfKLveiUj+UgapkUbl+Wg1liDzssei13OzJbYhXh7dBemgKYHLHl2yODxle2:r/cyelTpkUbQW8yiiFxhEmg9HLH3sxl

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2