Extracted

• • Target

    a66b115784c8fbd1509e746fc6534b0f1868ea06646ee37716cc7f6ed1029957

  • Size

    1.2MB

  • MD5

    175ca66946610b34717444893bc93845

  • SHA1

    59f04ef5f86eb915abb5b238783ff4103dd3b796

  • SHA256

    a66b115784c8fbd1509e746fc6534b0f1868ea06646ee37716cc7f6ed1029957

  • SHA512

    0964b10b5c4dfed8322de675bb9d5cce8149cf7e529d3ea0421e5c57feca1bacaf81ef3eb6d011d8b8a9596c0e8239812e606cbbea364174d3679ede8680f9b1

  • SSDEEP

    12288:HZsQYcBw+32JsgijZKfXxV3pc+BCwM8qtdV/4va11OFGRGnrgq1Gc:HyQbB57ZKvHZc4JRqt3QS1gFGRh3c

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2