Extracted

• • Target

    b439daa13221e440f868f139f62f63c8390821ffb81e69b43b899b394d6fbcb9N.exe

  • Size

    21KB

  • MD5

    cecb843de407b6085762057b666dcc60

  • SHA1

    2682ba87248e18bebd7f90237de53307ccfd393d

  • SHA256

    b439daa13221e440f868f139f62f63c8390821ffb81e69b43b899b394d6fbcb9

  • SHA512

    9ff87c05c67ccb815e2cfedb90cc8d8ce1fae6906b92c11638ee97d096aa118ef2035f35dbd9c98d5b03f661c69e2064cd14c58e1ae852bd35d6d34df3e1a81d

  • SSDEEP

    384:PIdmF+TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmhvYndM5SLP5pLR:PIsF8HdbKjV8BX7Vy6K7eIVaAndEKPl

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2