Extracted

• • Target

    JaffaCakes118_48e038344e222fd8a55bc2b239cf5a40

  • Size

    214KB

  • MD5

    48e038344e222fd8a55bc2b239cf5a40

  • SHA1

    089091feb7b6e7394f821bb5fe50163fc799070e

  • SHA256

    7d37d2d5ce380016446afaf8c89530dd77c5963bd6efc0f8030edffa85866466

  • SHA512

    ee9d883d453be2aaa3fd2e164610d08dc4627c5047876d8a79b5638dbb7cb8a5c2c8e162cdb524364f780bf695faa9da3dd29fea6651cd22246a18c608d058bd

  • SSDEEP

    3072:QIdTm6cSK7byXgF4CYLzm9ODN7YjPp28KXUwbGQPodub:LTm7SK7T42ODNa8Xbo0b

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2