Extracted

• • Target

    b59065499bf01070308b77d6ef1c2f3dc1478e0b2bf7e6b31ff24cb7cb71c47a

  • Size

    21KB

  • MD5

    6b317b46afd02c88e71d32056c10e040

  • SHA1

    86b90f32c93150d677b250db441c279955d1e237

  • SHA256

    b59065499bf01070308b77d6ef1c2f3dc1478e0b2bf7e6b31ff24cb7cb71c47a

  • SHA512

    973e5afd9ccf3a2ca1e13f66ac05f16d51d46df5a7f8cdcfc1ac6d9ac8e7acaf302c5ce9286564ef4f7fc0012d86b438d0f7ebe011c1e1631f72146efd22d550

  • SSDEEP

    384:rHIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlOpQ4+51kahMwpLR:DIsF81fG9QveLOYTe5YikpQpHt

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2