Extracted

• • Target

    JaffaCakes118_ab17de0ded062daabf603a5a995a5dff

  • Size

    103KB

  • MD5

    ab17de0ded062daabf603a5a995a5dff

  • SHA1

    f197e9ed2cf061551819592dc8eae13b4e9b25f7

  • SHA256

    51127ff33b1e654515d15dd4b1d97d79a1235e0faf4c99b06f22e235a4490e52

  • SHA512

    b094086d3a04e738d0245dc1963277af0f7ed6d68d79455801478838ae2f1fe70218c84fc6bf6074f7931da4699c83efd4e4afb7c169102349afeeb60cb28b72

  • SSDEEP

    1536:DE20Bp4Gj4tVY11hK4+6eJiHmrIDU4UsNB0q06p6tA+BlRXpMs:E4oFc4+6eJamnsNOf68tVes

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1