Extracted

• • Target

    JaffaCakes118_fbc4ae038d4a2ec5e97050b4170560f9

  • Size

    84KB

  • MD5

    fbc4ae038d4a2ec5e97050b4170560f9

  • SHA1

    664b5214116ea52c5e18e98364c5c4b25f14b5d8

  • SHA256

    b23637e9976fe510cdf4c202ed10ba0e85d163413b5462534b7a89c814e0c7bd

  • SHA512

    0dcc10bdde623442ea76fa6d125ac10c0141316cf5b23c0bd04470e662bde70eedbf0808085852290ec4a1eb993e3a2c9a2fbc938521c86d9cdd319972229b87

  • SSDEEP

    1536:k6ZHUqJSAEmiOiPQqvYtjePUbR5xyEiE8Js7zDOuaZohp:BxU2SHSklvYAMLQEiEEuxaZoX

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2