Extracted

• • Target

    f9ad54a0425e96542dd22b608656623a989c82fb857975816f1be06972e32eac

  • Size

    148KB

  • MD5

    9098621dcfe384e027c34a8cd62ff15b

  • SHA1

    63e8330f0bf5926484e311957309684fdeb61b1a

  • SHA256

    f9ad54a0425e96542dd22b608656623a989c82fb857975816f1be06972e32eac

  • SHA512

    1ad901d719dc8e3f5bb91b07b81d429654ea8a72a4a560003edeb38e639a2af0c3d893c539d56eaed99d10a8ab0bef02cb6e82eaec4603d0d77d201d3d4d233c

  • SSDEEP

    3072:CLT1KrpjC4wme/VW58ZXRXfX1irrDZC2kaIk21T+Dzh1DkLQyowO:CLTcDetw8ZpErXZAik+DvkLQ1P

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2