Extracted

• • Target

    1020457285.exe

  • Size

    421KB

  • MD5

    1f13d71974214e02ba361af8d9558288

  • SHA1

    987c2c52cedb24cf2c094158a2597b9728edbe87

  • SHA256

    b58f539f5c6d37ee35710aab52871e3c400d360486f706870b219e86ebb15ffa

  • SHA512

    d5eca31b6f971b5e1f62acfaf520814c579d357f747c0f2005b8a6ff2966a0db68f1f2a81b1ca1e065e679e3ad6b52d7179ceae835232721e1f2f62f49a27951

  • SSDEEP

    6144:buIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLDOD6HHVdCcJmOd:C6Wq4aaE6KwyF5L0Y2D1PqLS6nucJvd

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2