Extracted

• • Target

    JaffaCakes118_f7c8fb3e941672208832623c00042d67

  • Size

    61KB

  • MD5

    f7c8fb3e941672208832623c00042d67

  • SHA1

    1c24bdae294e044dff767256e180e000e78feef9

  • SHA256

    90c73004a698704f7252c3f941323425610a49bf909f4ee3f1579897ac2ab474

  • SHA512

    ac430bee2e37b66f6f1e31655350f33198af26fa96563a50490a1cc7cd825bfc3e764e4e72d6634d8099cb981bf9f0050663f5ff47e620d89ef3b6a4591779f3

  • SSDEEP

    1536:OqMxCxZyzT81Rap5R8mkPWO79RPbovi036E:ONxCbB1RapHDdq9hW6E

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2