Extracted

• • Target

    971548addc373b70e70c748ddb279cfd

  • Size

    885KB

  • MD5

    971548addc373b70e70c748ddb279cfd

  • SHA1

    0e77d592c9a243a172a4d72069f07b6d79a7209d

  • SHA256

    215b3350b74a68b685582e93b42c4763c6626df94cc2243281bf997d7d83d581

  • SHA512

    c98b06ffc9b809b7ddd22a35d5dade65b080268ca76f7b836d9110e7140056d0db022b1e8f06ff99713aec33565e82c0a1b338caf2d0c18a30a3b8da17e9a1b0

  • SSDEEP

    12288:s2cjEJnk5y6/FOD1ho6zWD07N0RoG5XS6SarFLhzFAkNoDF/UE5VmKT+A/ixVDN:spjEJ5cO5h/7N0RtpfFAkNkFzBZ

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2