Extracted

• • Target

    JaffaCakes118_1ad043f4482bd65efb19f39b882b7e82

  • Size

    324KB

  • MD5

    1ad043f4482bd65efb19f39b882b7e82

  • SHA1

    20e11dad6b7ad71dd9d0dac9eedbe77c3a363697

  • SHA256

    12530ec18d59d273926303c4b92400f6d46e0c8d10105328a48df8d4329b4eac

  • SHA512

    03937e63a96b8ef093e45eb2eabe85473e171f1f82e06554c0542b21adb6018c27a9f00dfb71423fba67643c1786b26f7b57e528225aea9f3072f684f427f677

  • SSDEEP

    6144:MiLsP0cENTm7aYR5vJTvR0ZA1wBH8EdL5FW/SZ13VlSnO+PEeL0WYey1KvP:MtMlZ8wBcEdtFii13DuLFL0WYevH

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2