Extracted

• • Target

    b9940e38ac42648f958a2f8b8cdd2935

  • Size

    284KB

  • MD5

    b9940e38ac42648f958a2f8b8cdd2935

  • SHA1

    3bcffc2b201b8da00a5c3e848582ebd2f2bfb130

  • SHA256

    d369022b5849f8f785ada5468a198643f39aa29f8007037d0aef37df92f9c3f0

  • SHA512

    57c072f71a08c9bbfb455e19eb23fc08a4b6094eb6b25ca271fb6b4b062464b702088d207c8b24f75245947a921b3d08f719b5376dfa690b38aeeec68d57387a

  • SSDEEP

    6144:snpAOgw8HYWO9UGBvVoYGrLHXiugVn+ut9o3aQ1dUDR7Y+Xt5u:snpH4HYWO9Dm9g+W9VQdC7YX

  Score

  10^/10

  xtremeratpersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2