Extracted

• • Target

    3a646a8c31601a926f0e5894b4b9d620

  • Size

    858KB

  • MD5

    3a646a8c31601a926f0e5894b4b9d620

  • SHA1

    5f1de4aec9676e67808e79c0ec2dba9c7945c8a3

  • SHA256

    ead823a1182ef6db2ea5c9ca725e253fb162c4d0a81552494db5e9c109aea263

  • SHA512

    428cb77937f3c8017da27a2edf89429851133cc0adbab544b8020c88b7311f6ca293e790637d85fee3076d13ea4035ad3973ded6fc1584f07e40dbe05a80084a

  • SSDEEP

    12288:2VPSnfdi/IZVxaoSkBBjjPOMccUXas2HFIKIgrdhx/AeoHv/pm:2SkmVTHPFccAH2HFIKIgRhxYeoHvhm

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Drops file in Drivers directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2