Extracted

• • Target

    JaffaCakes118_b79cbfb9f299a26c81d60b0457611b17

  • Size

    80KB

  • MD5

    b79cbfb9f299a26c81d60b0457611b17

  • SHA1

    6cb2e7a802187530e70911d9086748f7267adae3

  • SHA256

    2b9f5309188f2c3e09c24b8e5045588c60aee962a0f0d7878001051ae2a2e230

  • SHA512

    9a75e44b74662dbfa3553d7796b07694b71f936c3a00145a641fd1a57b53a30c08dbd1351320245ad1378fb8869ea5a48c5886d1c9c325e40451993a30b530ce

  • SSDEEP

    1536:CoDkIv7NZRGc7lcjEoAPf3R/rD45ZfElKns9:Co9dlHoAH3ijfElKs9

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1