Extracted

• • Target
    86b7b7ba056bd0cbbbca84e0dd4e7dd5
  • Size 67KB
  • SHA256 de215fbe071105e63bad7cf6cb488ca8fa3ac6402c3e679b6f24bbf228fad218
  • MD5 86b7b7ba056bd0cbbbca84e0dd4e7dd5
  • SHA1 92323da9042e6770ee73d50fac896b9412483629
  • SHA512 745959c485d33787c76f1377927d895a2e8971cf7f16686e1ad6f1f6e38b896e4442502c76c00fd505e66b70dabce1894732916c9ac019ad971bbe6b6356f36b
  • SSDEEP 1536:T/aqvRvzMqDqfA6HvG5SvjbDu8iHYWN8RyBVn7hOlwJSx1M:TiqvJzefA6Hv5bf884BVn7IWgM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    Avira_AntiVir_Premium_En_Activation Key-2012/Avira_AntiVir_Premium_En_Activation Key-2012.exe
  • Size 123KB
  • SHA256 f4ec593c1c0aa1f6b54e7c44a31da4e0161dea649a06b7f41f286ae4da834901
  • MD5 66a173eb1770809c39deb08ab53d522d
  • SHA1 234f0e5440d1a6e3bb59b32a8afaa158afb96cc2
  • SHA512 674e472bc0ca36172d0a0ba3e666458bae3b5c584cc8cf35c50d233318a54b6e40c537e8be4045a31597c8092432c18736cbef17bde6666f6acb6ee5986c9014
  • SSDEEP 3072:b1dlKwgj23+Oz05YoNozau+gIjZ0DGfaWoO7:b1dlZro5ydI6DPWoU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4