Extracted

• • Target

    4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

  • Size

    886KB

  • MD5

    40eaca541433514a31508b7a328db6ef

  • SHA1

    bca267e3a5007147c9c0cb44612bf6027b47ba76

  • SHA256

    4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

  • SHA512

    3fa774f21f13b349e3474ba6da9d0835151d31847f2051f731d24a71e8e6b66be0d35d495b4db9bed7f1697c55533c141b2b70f8d94d53d3e7b50e6cc9ffbf24

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2