Extracted

• • Target

    57cec6c53517fc2c805a907228476e65

  • Size

    248KB

  • MD5

    57cec6c53517fc2c805a907228476e65

  • SHA1

    f84854974afe1eeedb5727c5be9fc6b12e6827e4

  • SHA256

    5babf77880a594d6dee4a6d507d8243ff038a308a8cb4c3e0647bd46a70d8f18

  • SHA512

    238d5ccf1d097cee8af76e50b698627441073790661654b96cdc4984b1014872bb2d89588e01869a2b18f86022df54c17d5ed56c9aced9d387e5363d020e97f9

  • SSDEEP

    6144:IXHdcKJsBOuL0PYUl1IN4nd36tqZL3vUTFBddeqYQVvEfoaweqkq:KHmK8PJYKN4QtcbNyvTawJ

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2