Extracted

• • Target

    JaffaCakes118_30247f22c107feb1c35f4471ba4cfecd

  • Size

    277KB

  • MD5

    30247f22c107feb1c35f4471ba4cfecd

  • SHA1

    0235258bf258c3f48a96cb1154573d16fa5bdaeb

  • SHA256

    5b8f260d43a454fa6a9c16f4146cbd5bcd1c935318a6020a0bb2916f6d71eb25

  • SHA512

    7d465dee99cade329ae41cd903e6279dbb755cf527b88da381b644234fbe7a869dfd3e73a561053f6de5f4fa74f20679fa592f978020ef62dbdec4d353c98ec6

  • SSDEEP

    6144:OGxnbpdjjaur3jR2Z4zytbLfGPRD3Indz:1tdKuni4zkUbidz

  Score

  10^/10

  xtremeratdefense_evasiondiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2