Extracted

• • Target

    JaffaCakes118_b11a395e1ceeaf6930411da5b2b04a99

  • Size

    425KB

  • MD5

    b11a395e1ceeaf6930411da5b2b04a99

  • SHA1

    07b4a384067279d76a41d606efc3ef3dcdeeb3b3

  • SHA256

    48cf228b71401b027a37c253f59c5f837829969bc0f2259a2c2bbe0424d8fce7

  • SHA512

    ddd9634ffe59fa53be5d49712566a1b198eac4aecdd40dbe4f6ee052283eee958f46cc7014c2724d9dece8d84186b451c61cb172bb656e25961f47546ea3a01e

  • SSDEEP

    12288:AnOpH8rq4A/X5HbLBIkoZVx+lTI2IO6X4Yqm/Q3w:AnOR8rqfpLBIkoZOEm6XPD/Q

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2