Extracted

• • Target

    f19ffa724204a0e8e2df1ca880c30415b2d324faa4cf99c751e3c68cedcdf34d

  • Size

    67KB

  • MD5

    44a00429e87ab647f3ed8855bd958a77

  • SHA1

    2314a487f97b46e80b03cadbaa547ed056ab7898

  • SHA256

    f19ffa724204a0e8e2df1ca880c30415b2d324faa4cf99c751e3c68cedcdf34d

  • SHA512

    8deb4555095e4a0c168d30be418a178820893a25915f516a1e12ee8ea4a04968e3379bb83527c111278cf95018e0031db73e347e876e56f3ae91a1d9b1dafcb3

  • SSDEEP

    768:49m1Sq4NQErBsH1tzoisBKQI6dObAG/dqbuW29Ifnc6/yyR+P2ujfiipK9A+7Xo/:lsq+QV4rObAdiWpffyarmzNwiGo883

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2