Extracted

• • Target

    JaffaCakes118_65ef470b815c35e3d3ba87789b02e934

  • Size

    143KB

  • MD5

    65ef470b815c35e3d3ba87789b02e934

  • SHA1

    5b72285d4842263059bbbd495a0d26a2c72c4ede

  • SHA256

    e24d9da2dbfbec8b1e93a02bf1d59bd9008edfeb920d9c5f25f19fed8bce93f0

  • SHA512

    c6c7603985a7566eeb7a6ea1eb6299a8be8e293d541467ff41b1a309bd41d4e5054cc23c0d2acc3e3e0398a8200b08537cc9f046598633504e6501e61b642195

  • SSDEEP

    3072:TGR4K6+d7F5Zi0m1LHkN73r99vphNBtqKcOjygh:Tw4Z+RPZi0MLA3rLvp7qOjy

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2