Detect XtremeRAT payload

XtremeRAT

The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

Xtremerat family

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.