Extracted

• • Target

    239a6e9d655f69032bdcd8e0dd05335c82cd866713a2a39453783e5d4b42668a

  • Size

    224KB

  • MD5

    a05e9c78f9d6d317f8faaa3f28f7e3ad

  • SHA1

    51172978c5b97718a1d3a15fb645f685e2be8711

  • SHA256

    239a6e9d655f69032bdcd8e0dd05335c82cd866713a2a39453783e5d4b42668a

  • SHA512

    f01d16d010244105957b4ddda81c7ef061dc06875b12257954564d53f07eea43320077788a14d12cfd6ee1fef608d93f27731266f80ecc44f8bab6d4d6ee6223

  • SSDEEP

    1536:dwYL9p89qvUhhhhhOjY1CnhMZhmbQtahhhhhhhhhhhhhhfER+TIlyX8JWLAdKP0z:KynfS

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2