Extracted

• • Target

    JaffaCakes118_aa4ccbd33bb874d95f3875b938cdda45

  • Size

    661KB

  • MD5

    aa4ccbd33bb874d95f3875b938cdda45

  • SHA1

    1fe781405dd88e788d20df15fb7c286f20714786

  • SHA256

    0afc58ce1749d2597068672e1776aea12e43ab12fa384d082d5b39ee26264aaa

  • SHA512

    d00ec75e880f33890e38df5afc20c76e2acaca0091d398466e3016bda37d6758a84d7059ec37004f937b8c9f34e6282f8f4be6ffffda602a974a34a1e592164a

  • SSDEEP

    12288:EJMs6OY0uW5wwyPImzQ/+afpnRyY9jjU82jLbQNNPdb5JvnmcTIHQqHYoZ4w5mMA:OMBz0u0wwuFQZfpcYRzCL8VlJuxHQ6Y3

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1