Extracted

• • Target

    993945a4469d2a4df7441f00b3a9afb636c1a8f22c1fb84da636c103d415401f

  • Size

    433KB

  • MD5

    429eb5d1c09cdda88c7e3148dd135d10

  • SHA1

    d722535d958f4594dcd20b7b2697965f8104bc4a

  • SHA256

    993945a4469d2a4df7441f00b3a9afb636c1a8f22c1fb84da636c103d415401f

  • SHA512

    7e753c895c12aae35f8def4efe0fc0dbc3a2dac6abdbffab04e0c51145377e832a0eeb3cee9a6b44693f7bb4f84277c35f28b08c5e397cac2776497874dd2f78

  • SSDEEP

    12288:L8hknZKZlGRgO2qmq9kR6lhKX1B3a9FsqJKB57d8fKFdrAH7:LgMZKZcRgONmq9g64B36rKX6y/AH7

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2