Extracted

• • Target

    4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

  • Size

    585KB

  • MD5

    55c0e0fb391a3ce4caaac1c49ed1ac00

  • SHA1

    868da3a8c72eff600d54be3babe3721489a85500

  • SHA256

    4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

  • SHA512

    60a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1

  • SSDEEP

    12288:Za7XtTWupXNT35AcFqTCC5ktTWupXNT35AcFqTCC5I:ZEhZpXJ3SGqTCCuhZpXJ3SGqTCCm

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2