Extracted

• • Target

    JaffaCakes118_cc4db403575d57d64248731f91da83a4

  • Size

    128KB

  • MD5

    cc4db403575d57d64248731f91da83a4

  • SHA1

    ec09959025d37d236797868f21b69f1f936bd748

  • SHA256

    0db263ed519e4ff8650d19bf3e79aec015e7cf5296e02eac13fafa0830c63968

  • SHA512

    b51ec34706eb471e8ea72dbfa56f5e6e58605341cd0ad6603ef6cac357b33da58b621ca2335494472cad8a20056393e4280e4569ad52227104e4eeed045fe905

  • SSDEEP

    3072:qS6tBC9P1Efhq5zKX3VlDBqyuP1px1voPeEc:oBC9d4hMS3DYXPV

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2