Extracted

• • Target

    dd1dfcda8b11c8634f568fc2fb85af8a9e54fe6dc63a90fd5c91c7adebe4452d

  • Size

    21KB

  • MD5

    0747737f86ac6e934e7a4c01975b9060

  • SHA1

    d47b135b751fbc8df2fa5e52338ca42df850d02b

  • SHA256

    dd1dfcda8b11c8634f568fc2fb85af8a9e54fe6dc63a90fd5c91c7adebe4452d

  • SHA512

    c4bb24d8ca8a9a9d8da62ccf199f5ecb112a8ebf9dc2046336de2a430ab424f9e268b5ef7a52c931d086683beb5b58594bf47ebe8f92d1e0b5e50f12451b58cf

  • SSDEEP

    384:9IdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlw+pQ4Lyn+53ipLR:9IsF81fG9QveLOYTe5YiS+pQB+c

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2