Extracted

• • Target

    086f6c33df3043278a26ce6cde75634e8c234d40f7028e7f9732b1c4933a9298

  • Size

    854KB

  • MD5

    775fff0bfd1082d0faea4e46a6047c62

  • SHA1

    62c714ed229a6bee68dcd48ea0164c8d98965a39

  • SHA256

    086f6c33df3043278a26ce6cde75634e8c234d40f7028e7f9732b1c4933a9298

  • SHA512

    77171ade40c804fa148975e905d5928c5f5de16d9569138c2ac4ec629a23e614c4cc928b1bd90b343b8b71460407112d11423498f69bf8f7f9645c44ec5338bf

  • SSDEEP

    12288:UZOp3o7YNQmBeW8/LViyIakQz15bbPyLMcGXNpbyk8mVuTMJM9BUw/iz5YMM3Yq:2BwQDiyIakELac8mQYaUw/ylMv

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2