Extracted

• • Target

    cf74c188580783d47affe59fe5b7e739c316670084d4fd97cbdf7860d5386ac1

  • Size

    198KB

  • MD5

    33b8c4f7a722553e05e57555747cbdf1

  • SHA1

    3f51572d03c1fd08139c9058b38f5595898ce36b

  • SHA256

    cf74c188580783d47affe59fe5b7e739c316670084d4fd97cbdf7860d5386ac1

  • SHA512

    8c61eb12976f09cac5070a4e454c51d1eb23647ed411f0ef2e720a7d2cb8afde21a9b0ecbc42169b71e4d52205fd7bc3dad3acea5b04ea79aef58ff9660bbf1e

  • SSDEEP

    3072:ytdkdlzyXEGv08qVMDGY1/w4ABEoP6G6tdkdlzyXEGv08qVMDGY1/w4ABE1W0i:5MXfcbYHhR4tMXfcbYHhRM0

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2