Extracted

• • Target

    JaffaCakes118_d9798a31ce84b181f6883ebdbdc14aac

  • Size

    97KB

  • MD5

    d9798a31ce84b181f6883ebdbdc14aac

  • SHA1

    17aaae4a5d11f15514542abc45c58a38570ca224

  • SHA256

    4b8f2efc6b6708212a37f77d12106a05bfd95d2472b8b457ab106026931c8950

  • SHA512

    5d30fc7c6991ea2d657e8808f3174e3d2aaf3468f39bf5553bea4d60c6a578c654cbddbb36256d47bd69602bf830f570d6eaa6fb572e35f724e44fc5ca5d0791

  • SSDEEP

    1536:/7zXAgMgOFfBzXqNW71rcYDAWeotvXl6GLT:Tjl5OJjqNW7dEvotvX4GL

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2