Extracted

• • Target

    eda5bc2162c2f2e8d24ca4234f728b76b55291ec31d13d57eb38d156f8206e51

  • Size

    561KB

  • MD5

    2686afd221cf109f875b3029fab6480b

  • SHA1

    c243ae59033985ba4d643d5d19e10002d603b0fd

  • SHA256

    eda5bc2162c2f2e8d24ca4234f728b76b55291ec31d13d57eb38d156f8206e51

  • SHA512

    2a1679113d97a69610ae048655260f7b85e1405213fd547b66b2d1cb15531e6e68d6b7a5778b59481fc350f846f24a6dc2a0a5cfbdda1dacbf7a3363247c4cf8

  • SSDEEP

    12288:81QcT1KGnhG9kEiXVaxZeeCnnLNSGjxuVTFpLha8EkHdoHEVH:e9T4WTemjuzpLhaLkHyHEV

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2