Extracted

• • Target

    JaffaCakes118_e0c672cafabeb4b98982055a8f637648

  • Size

    1.0MB

  • MD5

    e0c672cafabeb4b98982055a8f637648

  • SHA1

    a2782ab9d62b386de7562f0a31ca29ef544cf77e

  • SHA256

    12572d2c30920f9da5eb3ca522332ed9a1cfd8605aaff5a7278ccba5b0ae7365

  • SHA512

    e7d3dc147b0b37f5886cdec3d2eec51b865c2429755c91180c2e040875a34a7959783f66bdb824a00c9a83850e33c4af76044fbf987664db65201e064cf2170e

  • SSDEEP

    24576:U0sc0ubwC1jKatOxUYHnqidDA7rh/iB0w+IHe8fAIwgw4lAAx9BhmroA:UBhAsHe8fAIwgw4lAAx9Bhm

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2