Extracted

• • Target

    5449cfd2164d003115510ac61daf3243cf97db21d677d5a3144a77c5572d3691.exe

  • Size

    558KB

  • MD5

    b1d86a3bbac67a44086df9c90fe30700

  • SHA1

    a378e1713b2a5ace554c9b29e622a49c52161931

  • SHA256

    5449cfd2164d003115510ac61daf3243cf97db21d677d5a3144a77c5572d3691

  • SHA512

    a96fb52241f0ddd4c2fedfc67ed5b645c7730cc1e3cc842139bf1094b37dca9f45f67f0e823e81748f75f59d96c8cedd9e392685cee0e7dacb500d1cfeb6be4f

  • SSDEEP

    6144:OwW8yO1I3FODqRQ290R0++gQaCJFF8DipytmjRXI1ODsGT0D5q+LtlmzyupgOwKi:pyZ3FZG++pDvtSsg01vazrpgOw

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2