Extracted

• • Target

    7dca5b27a7a6ad3e8a5d910c3798c8f2

  • Size

    88KB

  • MD5

    7dca5b27a7a6ad3e8a5d910c3798c8f2

  • SHA1

    b7da4adde00099a854b893b20059cd4a358d49dc

  • SHA256

    0b30c86d1ed315370a7bc285fbd4a93f910c993a77e3d2f47cc800f81c9875cb

  • SHA512

    602685a0db0efe40a0b45421bd45c82302869b8391c61309a0b4ac0a1756f6f2832c4fee6219b11b6e1af89298f636f3f2c5f3bcfc00a7c0014b52be65f4d0dc

  • SSDEEP

    1536:SIF3NPZ+Ta57cE/EmJ2Dy80iUV51efTfmZkEsAPTaabPApa+f3md:nNReaJF/cy1CeZ9uazwaYK

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2