Extracted

• • Target

    7cc0adc3e5901de13af13530fe7f12e8dc9b02f6a68072f170e89dce06dd11d7

  • Size

    5.9MB

  • MD5

    2fbc0174ff722d1f00707e6a27e5dd80

  • SHA1

    8a659170031f322b219281a4cc3ed6d47c3aee75

  • SHA256

    7cc0adc3e5901de13af13530fe7f12e8dc9b02f6a68072f170e89dce06dd11d7

  • SHA512

    c9f88b2cc414465badfb40e27c30c6eddc41311967e0c9ff10fba7fdf2b6cb777aa439cd55472383b51b88cd3c501b8c820ad591015d490910e6e1fdcdd48c2b

  • SSDEEP

    49152:hYK3LcULK7n6FHbkDO8nqqh3vZuCRWDovqxXXGqQIBJotMMDqUSGm2td3r7EdUFe:8kyDNCWCEM+m2L7D30X2ys

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2