Extracted

• • Target

    JaffaCakes118_23e1abb5ba4e2c1b23f203b080af42a2

  • Size

    323KB

  • MD5

    23e1abb5ba4e2c1b23f203b080af42a2

  • SHA1

    505db8d9b5ec0f511285c826df934d36bed7f401

  • SHA256

    bb6b6dc9e04213abd1dc3f1325621cf42b3f04b44058b1190e8af0265e57d3e6

  • SHA512

    e0039f030cd0f1553a6b9b24c8ec2d13e883d9f2c96dba6d7da5a9cf307d28f024396ce52f8e95a8fef33a8402600e3bda724e1033675305d71aa4b9258c24c6

  • SSDEEP

    3072:tYFpijtYA37CFr1Bxw0E0K37+NSHTNWVQ3MhJF8lZfhr4csKL6SrpyVHVDNJ:aFIA1XwRDPRWVQ3+klZfhEcsKL6l

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2