Extracted

• • Target

    JaffaCakes118_79724247bb2a37b08c81a129a4c64ad2

  • Size

    680KB

  • MD5

    79724247bb2a37b08c81a129a4c64ad2

  • SHA1

    fbd3b48062bad4d3cb4926bc5e41f52fc3848746

  • SHA256

    54958284ba0c7cd35e5317356d1c8a6971ffbb1c0db8c3c61a0c9f78b4102212

  • SHA512

    aa6fba899ecfc6502c169892e55a89907232dc013ac0a719c6a9062b60f267a7b07b2a51053b23bc6c379d0728e46d9bbbc968299add2f7413896674cf729da8

  • SSDEEP

    12288:UNQRh1L/MbagmTmiwTjFw0cP+Ec1KH3iWOF+wuslaYH0wfVcVqaGH32uOP7CW7hT:UahkbagmTmiwFw0cgKSF+wNlamcVqaGx

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2