Extracted

• • Target

    5352dca0fb18c755d8ebe6b73b4fe5e1ff115b518fd61d0ac31f089ec6ab3e33

  • Size

    21KB

  • MD5

    6ef8b723f274ba70e44f2ecf70a2737a

  • SHA1

    5a10939c81e8e9d6f7dd56a7fc3feda13e89e7be

  • SHA256

    5352dca0fb18c755d8ebe6b73b4fe5e1ff115b518fd61d0ac31f089ec6ab3e33

  • SHA512

    1f2f854ef5dfb7195ab6b892de897f709a3afd45eae6bd9d7ed510840c52210626b314409aa116aa636ab376832915dbab64a5ab5370674c64f5f775afc1dba1

  • SSDEEP

    384:rtIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlckbzb8Q1ppLR:5IsF81fG9QveLOYTe5YiekT8o1

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2