Extracted

• • Target

    575db21a5dc340c665e677bade789e3d

  • Size

    224KB

  • MD5

    575db21a5dc340c665e677bade789e3d

  • SHA1

    b083f5c6e289f61799e2d9a1d20b84ee6b99a077

  • SHA256

    006c2f9910644d6cb24c2d325a55d95f36beab9854a1d80f13091507c785e72d

  • SHA512

    ab701a638ae6fc98a8429bb6b4c352c702e34c9ba709cc4d85c7cc2456987b79e604f726bdb7890999ca612a6c347c9d301a91118a73e7e5202c7e7d2ec93855

  • SSDEEP

    768:gJfN8ZTmp3eVLWkaxuUl0+qn+NT+Eo+wWGQYmSs1QORV1U5Wuftxv31e+mLSERt4:gJfN8Zgl2fx5mbRtPrL91FFk

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2