Extracted

• • Target

    JaffaCakes118_611f63338de0110fe337fb41d9f18fd8

  • Size

    427KB

  • MD5

    611f63338de0110fe337fb41d9f18fd8

  • SHA1

    6b8a8bc6b42294300bb996a86a87186ffdb7bea1

  • SHA256

    4d9ac45fcd48d5ada906bb7cd1020255c7e968b428c1335c1a8d71030856d2e3

  • SHA512

    1d8c832ea9879928117f44366c964b02e9435e40732e616c082f9cbeb32cbce20acecb1de698a55959b9666ca053c5875b2a6a01d5468c7808242ef6ca2ce43e

  • SSDEEP

    12288:FoS493ACIl7vI1kiqHNnyVek/a4QmHNX467poK7ZD:FoIjIbgyLC495467OKV

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2