Extracted

• • Target

    309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514dN

  • Size

    376KB

  • MD5

    3d84e7f15f1562ecca7d53ad3434b7b0

  • SHA1

    4b80e73a0913dfb5834d0c8c5a3dec13c83402ea

  • SHA256

    309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514d

  • SHA512

    45391d8fd3e1d4374118832371191928fd3d704512df7c0fb88fca5d471329f1f5b33c3205369c0c81f3f58ffbefffbb93d2b18aa6eb56f307973513b4ff5f24

  • SSDEEP

    768:NMuijtHfPN8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGS:mNPpsq+QV4rObAdXWpf/y+4oJuMc

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2