Extracted

• • Target

    Notificacion_ReunionDeDemanda.tbz

  • Size

    121KB

  • MD5

    a9cb4efcac5b5f8aec4dbd7166cb860f

  • SHA1

    14a1cc2e1dca8ed9934569ca0f302d9d3c33148f

  • SHA256

    0b430fdf7a3b364d677e4bb08030e5e0545ab45e534c9b9e9fa1dbf47503e9da

  • SHA512

    c510dcfa13836cdd6e07946ff893f333ad230f9943391816dc4b98ca83f395f7a13635210bf45a8057f7973841aaa9db99325e24645cb44e9f65efeac42ae575

  • SSDEEP

    1536:XXdP0bAQRC09QQ6fmuKU2ZBi1biuXKQ07E/aMMcLkz2A+/s/:Xc7RC09QQ6fmuKi1biuF0/X6zM

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2