Extracted

• • Target

    06200e5c9b628b10916c913577407398195cdf3a975ed4585046f33f1f75daa3

  • Size

    21KB

  • MD5

    0728c3cbd305ed5562af33bbfe9aea44

  • SHA1

    7b7208a3fe8ce69ad76da38e608cc2d1fe1d278b

  • SHA256

    06200e5c9b628b10916c913577407398195cdf3a975ed4585046f33f1f75daa3

  • SHA512

    21de9b122bc71524017490c4e3cfab59850e036b0a2f7f566870ec2b279f0ad3c84000e0d0c3887610886d921772322ec2c47d1becabbcc411df4fb56a016c86

  • SSDEEP

    384:gPIdmF+TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmiTdpvyUIB3mQu8TB:eIsF8HdbKjV8BX7Vy6K7eIVTTdVIIC1

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2