Extracted

• • Target

    JaffaCakes118_e6ee51832750f81ede27aa934bdb9653

  • Size

    202KB

  • MD5

    e6ee51832750f81ede27aa934bdb9653

  • SHA1

    b4682f6ecc48a32f5b73174cf967e29459b6c1c2

  • SHA256

    1043e51735e933b8878c576fb34d17663d79c62fc55c6f3f53bb04bda5e5145d

  • SHA512

    d2d4b30382b37040b553da79f926205cbeef6921c36f36d4998d62dbe5321bb400f4a57ecede97fd319afedd97f7d4abe85f178892df50362bacb9466f631a94

  • SSDEEP

    3072:tYFpijtYA37CFr1Bxw0E0K37+NSHTNWVQ3MhJF8lZfhr4csKL6SrpyVHVDNJ:aFIA1XwRDPRWVQ3+klZfhEcsKL6l

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2