Extracted

• • Target

    962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305

  • Size

    20KB

  • MD5

    1cb71351313f803483081c2502c1f5ef

  • SHA1

    0191cec46fe163f580a128525660243c0557154b

  • SHA256

    962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305

  • SHA512

    dda100e5d859fdd80603f1fc48088dcfd897a0ea4e845116e8d2ef0e094e0a7254a657264688c84f52ee9cd738267d13661e41953232ca0cf3fa6e3d49d2b75d

  • SSDEEP

    384:OIdmF+Ti213fEF9QZd/cBr5lholKKNW9j8MKy6Kli+9+b9eeOmZU+YG3l9PLR:OIsF81fG9QveThAxN+l3wb05mZQm

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2