Extracted

• • Target

    JaffaCakes118_efd0b7be6a79ea322ca33bcd6b6a16a8

  • Size

    600KB

  • MD5

    efd0b7be6a79ea322ca33bcd6b6a16a8

  • SHA1

    73dada257b99613d2b74495ba7babd8a74f7adc1

  • SHA256

    385270587c4693eaafbee4a85c8cea648cc737146b331d07f5be213188296355

  • SHA512

    a9004fb2b17126c81cbe1b47e58f03115673f702219daebdfe804ad367fdb34fa21f8b58d9ff843faa5641d78c5781f86276e07be7714334c9deee0f0c19c934

  • SSDEEP

    6144:bet53wzrM3sYpc/uvoP4kg9mX4h5u/aA1l3WQwzrM3sYpcQJwe:bG9wZ0c/u59UtWQwZ0ckw

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2