Extracted

• • Target

    JaffaCakes118_41fdf8fba3aad7c73cd69a9459b27991

  • Size

    460KB

  • MD5

    41fdf8fba3aad7c73cd69a9459b27991

  • SHA1

    b8a56d1492e3f6105657f8096afe7b9d2ce781f2

  • SHA256

    3905c0a4c7f1ec249cc34451746287273c90d2d5a2911322cadfa6952a50e58c

  • SHA512

    9cec73a9b059ae4064188f4bb310aab419e43f3f0d52f554f5606932272a3bde27a1046a84b53e308c0c7770e4630f1bd83edce2bebbf0fa50184650f5801f59

  • SSDEEP

    3072:pJrwYt0A341JoBGdzScGT1dfS8oVe/6SkUm614lInJloqH1A:KhA1dqVeSSkVi/H

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2