Extracted

• • Target

    857190b9b1bd6ad6df51a732117e3cd385a72969969257436b4ceb382f76bcc3

  • Size

    282KB

  • MD5

    6be1b22fb2e8f567d18f4e62d9c642d4

  • SHA1

    f8c13e725db09875118aa7b5d079919bc2204b19

  • SHA256

    857190b9b1bd6ad6df51a732117e3cd385a72969969257436b4ceb382f76bcc3

  • SHA512

    30c0fd48b983a5d7e3a6c312145d7f359eb55e165cc7f97d41802091325d8ab7f36df123bd1858bdcebf207117b34085ba56d16aa913d4871b42614d131ff7c7

  • SSDEEP

    6144:uez/2UsL9fkbClnVW5GJZ2tNYLj8MfsawVmpE7:VmVzYKj86sf

  Score

  10^/10

  xtremeratbootkitpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2