Extracted

• • Target

    manifest.rtf.scr

  • Size

    907KB

  • MD5

    71c5d618ca7c23f9a047a09ff1e85439

  • SHA1

    94a8f295935cad0cd03017b23ce115931f7c13f6

  • SHA256

    0e9b42ef9a5663d38c5cf3161488086a36e04834a6b231bf87486efa56081e3a

  • SHA512

    950683cb16158c461a68cc61f890492492d9eb25a2fd4a0712ded084d1d4b98dbcef80c3de14f0670cc44fd0c68c9cf9252e752a5cbc93b7dcf22f90b141b701

  • SSDEEP

    12288:2hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a0CI5YRBuhI0SjxXt3M1h:mRmJkcoQricOIQxiZY1ianaYCuxy1h

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1