Extracted

• • Target

    JaffaCakes118_5e759ffa0eaf6d803a2bcfb96333fa05

  • Size

    181KB

  • MD5

    5e759ffa0eaf6d803a2bcfb96333fa05

  • SHA1

    98364870880c8a2949fb0ebf9b5657656f06f50f

  • SHA256

    347d084d05607b4b0fd23c05514bad962bb2a463be40c6a159c2d898db51b471

  • SHA512

    a1b5d78cb2ce5ec0fc44e41a8ac6e4d8f3d5d8f2bebb976ef38d33c3d63aa90d685a43432a2ebc5a7bf3889864fba1805145c34c7f79f2f04deb6c386af8369a

  • SSDEEP

    3072:rgsC9mEklhJM6/0RwaD0Zlo5XfexDruXHnHeqn0dViqu3C5rpEnJC/Qce:o9mMc0rDNXfA+HpGViqJ2Ae

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2