xtremerat

General

Target
9c0f15d4b2b716efa114ad27a5e759cc4811c5b8d64cf1b713777dcbd628d326
Size 300KB
Sample220708-h7pegahag3
SHA256 9c0f15d4b2b716efa114ad27a5e759cc4811c5b8d64cf1b713777dcbd628d326
MD5 41067cbbcc67bc6a3f1452aa9282ec0f
SHA1 9fa39399e8d8e8027dfbbe12e4a023f7ee3581e5
SHA512 c39d4e0d833c28f74d0564a97cf43733741336e246f6bcde8497a3bace6e653016e2fe993bc70ac47eb47403de44160973b1d6da6bacdc0caf341aaf4a899d35
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

mta.myvnc.com

Targets

- Target
  9c0f15d4b2b716efa114ad27a5e759cc4811c5b8d64cf1b713777dcbd628d326
- Size 300KB
- SHA256 9c0f15d4b2b716efa114ad27a5e759cc4811c5b8d64cf1b713777dcbd628d326
- MD5 41067cbbcc67bc6a3f1452aa9282ec0f
- SHA1 9fa39399e8d8e8027dfbbe12e4a023f7ee3581e5
- SHA512 c39d4e0d833c28f74d0564a97cf43733741336e246f6bcde8497a3bace6e653016e2fe993bc70ac47eb47403de44160973b1d6da6bacdc0caf341aaf4a899d35
- MD5 SHA1 SHA512
Score

10^/10

xtremerat persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Modifies Installed Components in the registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Modifies Installed Components in the registry

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2