Extracted

• • Target

    JaffaCakes118_b576012606e333adc7a4be80a9a7497d

  • Size

    85KB

  • MD5

    b576012606e333adc7a4be80a9a7497d

  • SHA1

    e36d0a3766ed60d5c1cdebfc61d5afcf0a9c5870

  • SHA256

    13e911897980468e46023d4ffe0b63328e9c178204bf62c8db379ba0b2412075

  • SHA512

    78c89a21cb817946bef61a87bdaf328bd62a9e313a21b46612b5274ebe4cfcf628f0a747113e8c05ef98311110d0df8617dd2b0e94b31d3d0a883cac7307737c

  • SSDEEP

    1536:Fat+9WiffOKWXO9dGigfIemdSWMXzbqj5l7zbOQCzqYwUdrM8yp4TJj:FaI0i3OKWXO9YMesSWOu1l7nOFqLUdLR

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  behavioral1