Extracted

• • Target

    838f09135a6741e7dec0e91b348ce34406d0b632897f1caba00fb7eee13d09f7

  • Size

    614KB

  • MD5

    d3e489837c6dc761b9a1d355d0aea80c

  • SHA1

    0f089235f5d4577bc5df82f44067172149786dbf

  • SHA256

    838f09135a6741e7dec0e91b348ce34406d0b632897f1caba00fb7eee13d09f7

  • SHA512

    8444e82b0a6fa0fddf9443c6e82a7c68b96fbfdd03907f427d2243c71af0909a83ec65788e51efe860de47c98f97e267eefebdd196865fc69303fd7e95ab3311

  • SSDEEP

    12288:aK2mhAMJ/cPld+1Ys7XVEIoXYbAgtDvfPPiyVDQBmQ48GraUCXGM00pT9t2pR:r2O/Gld+1Ysrco0iHhhQBmF8UaUCj0TH

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2