Extracted

• • Target

    f2f669abf7a704d2491d84863dfa00374cb399be75a9d49f5f7df39ef48121ca

  • Size

    99KB

  • MD5

    a6adb73892aad9de5da0c9e01a5f8a8f

  • SHA1

    c7689a3be3ab4071e7d10e2a61eed6d231c16a20

  • SHA256

    f2f669abf7a704d2491d84863dfa00374cb399be75a9d49f5f7df39ef48121ca

  • SHA512

    dea0eca85fc6ab7abd643e5bfedc3b0d0d8ed4e2fca890126398ac9515ab2c5700c7d23ffbd6a910e0ce6e6f123fd9fc7e33a856faa39201399ca3c89eb3a9fd

  • SSDEEP

    1536:c33e3GQlkUxkzTQRmHBvhVLW62H/e6VnPp31x+Cr2c4Cchf97:ckGQlkUxuTQRmHhzEeu3trNchV7

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2