Extracted

• • Target

    3062fba336cba9abdac08ad66f62dba17e26c526066deaa9db791409656db0bf.exe

  • Size

    93KB

  • MD5

    6487ed8823f00dec8b32896eebbd258a

  • SHA1

    50b6d5315cc5904e37a831203af541df90f82f13

  • SHA256

    3062fba336cba9abdac08ad66f62dba17e26c526066deaa9db791409656db0bf

  • SHA512

    9fe34a8f5eebadb45f15e65958f9764e230d49aeb0e3950ce59a4cea0c323244255ccbcafdc0204681ea9e55e243205c0792dd518d51bb1540ebfd304f02ed85

  • SSDEEP

    1536:9G2EnTramCVTJ10e9yhVutjs53Oztfk/aE/pKdwk5a2ju8XGU30jtNH:9ynvBCVTJ10ey0tjs53Oztfgod9LwwGb

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2