Extracted

• • Target

    JaffaCakes118_adf194c16dffe2bb961a607324ebebfa

  • Size

    304KB

  • MD5

    adf194c16dffe2bb961a607324ebebfa

  • SHA1

    bf03d4140d0f8d57e53dfd12b113092d87cd400b

  • SHA256

    13dc98528c16aa8e09ad30d7a2290055958b591e676a30f1581a4f9f9c617e2d

  • SHA512

    9220be890d0f15c244f1434fe359eb119950da8d7983da4c0846786edd09f7e23c184e86111bdbf77c82d93b8c37b3abeed053bca767efd46772360353c0d390

  • SSDEEP

    3072:KBh0HNt/Yx5Ce6y6BOykct57s6nWqB3srCIHRx7EAQ6tQgOjDY/tJm8zl4mEXrkV:KP

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1