Extracted

• • Target

    JaffaCakes118_a264e27d62ebe7928bf39ce92d6a9293

  • Size

    93KB

  • MD5

    a264e27d62ebe7928bf39ce92d6a9293

  • SHA1

    e2f984642a80861f7461339d158726762e55484b

  • SHA256

    068f005d603e86227683dc2489c26aaa898232d6c76b75f221f3815fc7fa508d

  • SHA512

    2ce781a56570a6492dc1607627393a3cf956d201851397ec88eb234d8557de05df0fbe898ade6e6e2d2ebed3c90c097ba7151a0815c596e7cd845b83ac62e808

  • SSDEEP

    1536:LoQgvnH7Q+U4sqkn4gCrvSYyCvckT7aNxhBs+BTf8o5VZ8j8C:fgvnH7Hj9gCDXvPT70xhBs+9fvIjB

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2