Extracted

• • Target

    JaffaCakes118_7a0e2cea3f47bd9479b37bc0a4b89969

  • Size

    112KB

  • MD5

    7a0e2cea3f47bd9479b37bc0a4b89969

  • SHA1

    85259147af9a72f40933c5e4c98b902e1b145d1d

  • SHA256

    44e782b54cae0368d435966bc0289c44e37b6fae17022bbb0eef32350fd98f1a

  • SHA512

    b8c76057cda66573779133648498aeebe76cbc3df30085b63beeff8a4cf670cef273113ca883dde9fb04e7f009eb6ade692a9046d6f52d8293823ad083f2c18c

  • SSDEEP

    1536:0jrHi6anpAaoj9HDekSx9hFbP8xjEN14Ur9vMbAF9EHQSFj:grHi7npAaojNusEN14+k8FSH/

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2