Extracted

• • Target

    3c0d8ae00bf66229b3d7f1fdd8049adc

  • Size

    216KB

  • MD5

    3c0d8ae00bf66229b3d7f1fdd8049adc

  • SHA1

    7b97581fdfb7e1de3b89c7e6d228ba9fb66291fb

  • SHA256

    c6d20abd88b10a08256ebbcd71626802629e7275f2fafd2fd49562210e878a43

  • SHA512

    4c17663cb701c78bdbdff081f8481451513a718f37ac5b52c1d3e93dab61650e7813677f0bbd00f987a2595228660904eb4ceb1981623036f0516d36b870afb8

  • SSDEEP

    3072:CLJMeQm+h3MqrbgwLzUxDPJn2ibmzCm1b9nxvw6pi29riC5x:WMeUgwfURlnC+mt9xX6C5

  Score

  10^/10

  xtremeratbootkitpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2