Extracted

• • Target

    0228c318effe6739bdadea95d0281dddd2547ec2a73ef0739aedd6105a001fcf

  • Size

    295KB

  • MD5

    6eafe035d9eed699b0bd7c699c118992

  • SHA1

    3154074029b24b0b76c30f6d86789264c5c72535

  • SHA256

    0228c318effe6739bdadea95d0281dddd2547ec2a73ef0739aedd6105a001fcf

  • SHA512

    1bd1e3dbf1ffc3d23981c959a4ed9c73cdf1ddaa8ce2b1b6d6a2ef8c92902781d446b0b0b0a5815829ff05fd86b68f8476ecffd67b8bb1959f6c15efdce55912

  • SSDEEP

    6144:Yb/QetbVSltxYxmQZUtTk2mM2wwrcT326M+8sLelHVnBQ1WbkCBi:FY08UtT3mM2wNTmR+OHVBhnBi

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2