Extracted

• • Target

    910b204d21b084ca360e999dc7b8c62c8f7ab03d1fabb144403ded43a254e7dd.exe

  • Size

    21KB

  • MD5

    999d79780ce646ec198a48fe71cca237

  • SHA1

    84e361373cf278e28f63abfab62ca4820e28c481

  • SHA256

    910b204d21b084ca360e999dc7b8c62c8f7ab03d1fabb144403ded43a254e7dd

  • SHA512

    020f5e9b4cabccde35feb867f3f6208dcb80f2a4235058e047576300e1d9c72b69dbf39e6de1e5a61396c6d20bed54df147ac25822a70e5802c83d8880e08c93

  • SSDEEP

    384:PIdmF+TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmhvYndM5SLP5pLRb:PIsF8HdbKjV8BX7Vy6K7eIVaAndEKPlb

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2