ExtremeDumper.exe Flagged as Malicious by Windows Defender

[ls1x]

I also found this thread on AnyRun:

• https://any.run/report/05fe821ccb6c4fa9a7ba97c273911e7b8111553e6c3b0076f4d52a65d00f0be2/8383e303-b5fc-4fea-9142-87407cd89feb

[merces]

Thanks for your report.

Normally, "Hacktool" is how AVs detect red team tools and other offensive tools that could be used as part of an attack. The AnyRun report might be a FP too, but I don't have time to double check by analyzing the file right now. I'll leave it open in case someone else wants to share their thoughts.

[oldkingcone]

hello!

It does look like this executable itself is infected, as you can see from the live task i ran last night:

https://app.any.run/tasks/7f6501e6-7c9d-492b-8651-09db64953bd6

It is safe to say that this file has been trojanized and is used to spread DCRat, the installer.exe process that is started as a child thread under ExtremeDumper.exe does call a vbe script to launch the main DCRat process.

100% malicious.

---

Edit

I am not sure where this guy got this version of extreme dumper, because i just pulled from the repo that is referenced in the installer, and the images are clean.
https://app.any.run/tasks/c553fe64-67ba-4761-b725-279b2ff627fd

So can OP please post where he got the binary from?

[merces]

Indeed, the SHA-1 in https://any.run/report/05fe821ccb6c4fa9a7ba97c273911e7b8111553e6c3b0076f4d52a65d00f0be2/8383e303-b5fc-4fea-9142-87407cd89feb report is 811CEE0289FB57C2A37204C7131BF91CFD54CF70 while retoolkit 2025.04 installs different files:

File	MD5	SHA-1
ExtremeDumper	58db100b228ff17f83726d4c2738990e	d69bfa9ddb32de1999760e8b3b3236bc8934d66c
ExtremeDumper-x86	d662f3f3ac67c211e2bafbef223adde4	aa89a3b2a6322e50c278dc3e7535be4c47cd42ce

The MD5 checksums are available here: https://github.com/mentebinaria/retoolkit/blob/main/CHECKSUMS.txt

They match upstream version v4.0.0.1 too:

$ wget -qc https://github.com/wwh1004/ExtremeDumper/releases/download/v4.0.0.1/ExtremeDumper.zip

$ unzip ExtremeDumper.zip 
Archive:  ExtremeDumper.zip
  inflating: ExtremeDumper-x86.exe   
  inflating: ExtremeDumper.exe       

$ shasum ExtremeDumper*
d69bfa9ddb32de1999760e8b3b3236bc8934d66c  ExtremeDumper.exe
aa89a3b2a6322e50c278dc3e7535be4c47cd42ce  ExtremeDumper-x86.exe
5cc3f21a81438d8d24a82e3218541a00e51c6978  ExtremeDumper.zip

$ md5sum ExtremeDumper*
58db100b228ff17f83726d4c2738990e  ExtremeDumper.exe
d662f3f3ac67c211e2bafbef223adde4  ExtremeDumper-x86.exe
5a175dbbdd3ef221fc1cc8cda9988c33  ExtremeDumper.zip

[oldkingcone]

Indeed, the SHA-1 in https://any.run/report/05fe821ccb6c4fa9a7ba97c273911e7b8111553e6c3b0076f4d52a65d00f0be2/8383e303-b5fc-4fea-9142-87407cd89feb report is 811CEE0289FB57C2A37204C7131BF91CFD54CF70 while retoolkit 2025.04 installs different files:
File SHA-1
ExtremeDumper d69bfa9ddb32de1999760e8b3b3236bc8934d66c
ExtremeDumper-x86 aa89a3b2a6322e50c278dc3e7535be4c47cd42ce

and they matche upstream version v4.0.0.1:

$ wget -qc https://github.com/wwh1004/ExtremeDumper/releases/download/v4.0.0.1/ExtremeDumper.zip

$ unzip ExtremeDumper.zip 
Archive:  ExtremeDumper.zip
  inflating: ExtremeDumper-x86.exe   
  inflating: ExtremeDumper.exe       

$ shasum ExtremeDumper*
d69bfa9ddb32de1999760e8b3b3236bc8934d66c  ExtremeDumper.exe
aa89a3b2a6322e50c278dc3e7535be4c47cd42ce  ExtremeDumper-x86.exe
5cc3f21a81438d8d24a82e3218541a00e51c6978  ExtremeDumper.zip

yea, i noticed that too. the trojanized binary is kind of sloppily done as well, it just loops forever spawning DCRat in the background (like it was done by an amateur.)

[merces]

yea, i noticed that too. the trojanized binary is kind of sloppily done as well, it just loops forever spawning DCRat in the background (like it was done by an amateur.)

Since this is meant to be in a VM used to analyze malware, it is possible that OP had its .NET binaries infected by malware at some point.. does it use entrypoint redirection? Can you attach the file here? I can take a look later too.

[oldkingcone]

Since this is meant to be in a VM used to analyze malware, it is possible that OP had its .NET binaries infected by malware at some point.. does it use entrypoint redirection?

i didnt look that far into it honestly; but id imagine so. or it was some custom build (which i am very suspect of this being the case) since extremedumper doesnt have a 64 bit version in the release within their repo, and his file is ExtremeDumper-x64.exe so until OP shares where he got the binary, im considering it a custom build (his custom build).

[merces]

since extremedumper doesnt have a 64 bit version in the release within their repo, and his file is ExtremeDumper-x64.exe

Good catch. I've always thought ExtremeDumper.exe (without an architecture suffix) was a 64-bit version but:

$ file *exe
ExtremeDumper.exe:     PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
ExtremeDumper-x86.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

[ls1x]

Sorry for the late reply, but the AnyRun link I attached to the original post was not the same hash file the Windows Defender on my VM Detected. I was just googling around and I found that AnyRun thread but I didn't verify through hash because I didn't want to remove my file from quarantine (since I was scared to analyse it)

[ls1x]

The binary on my VM that got flagged was from the Retoolkit Repo, but the AnyRun link was from somewhere in the internet

[ls1x]

I apologize for my mistake I should have clarified this since the beginning of the post. So the original binary from Retoolkit is fine?

[merces]

The binary on my VM that got flagged was from the Retoolkit Repo, but the AnyRun link was from somewhere in the internet

Understood. In this case, it is not a valid comparison. On the other hand, I verified Defender indeed flags ExtremeDumper-x86.exe as HackTool:Win32/Malgent!AMTB, so I'll keep it open until someone has time to analyze this binary and tell us whether it is a false positive or not.

I apologize for my mistake I should have clarified this since the beginning of the post.

It's fine, we're all improving. Thanks again for reporting.

So the original binary from Retoolkit is fine?

The best answer I can give you is the one in the FAQ:

retoolkit/README.md

Line 26 in f86f5e6

I don't know. Some included tools are not open source and come from shady places. You should use it exclusively in virtual machines and under your own responsibility.

This is because in order to guarantee a program is not malicious, I'd have to look at the entire source code and compile it myself. Instead, I usually download a compiled version of the program, test its functionality and then add it to retoolkit. All I can say is that Defender didn't have detection for ExtremeDumper-x86.exe by the time I added it to the kit.