Extracted

• • Target

    691733c6afb6ca2338693bcf93df8f547354db0b22ee5488327e105174ed040b.exe

  • Size

    21KB

  • MD5

    ca5f95813033040a950becd192840cb0

  • SHA1

    de3d29e33291b0879263ebe015f29851f7f76dcb

  • SHA256

    691733c6afb6ca2338693bcf93df8f547354db0b22ee5488327e105174ed040b

  • SHA512

    74097304ae14ae23d99b9975a917635e24a69be61976a291b1d36d2bee525a8a597f2dd249d22b76de9e1adec59d00b1e935f72b24b2e59178936fb68d6fc9e0

  • SSDEEP

    384:rqIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlEZQVb3fnVvj9hpLRB:uIsF81fG9QveLOYTe5YiyZQ3fpB

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2