Overview

overview

10

Static

static

4adbe2d653...d2.exe

windows7_x64

10

4adbe2d653...d2.exe

windows10-2004_x64

10

Resubmissions

11/08/2022, 15:42

220811-s5lkxabda510

12/07/2022, 11:51

220712-n1lynaghdr10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2
  • Size 886KB
  • Sample220712-n1lynaghdr
  • SHA256 4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2
  • MD5 SHA1 SHA512
Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

  • xtremerat

C2

  • feelmepkudie.no-ip.org

Targets

    • Target
      4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2
    • Size 886KB
    • SHA256 4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2
    • MD5 SHA1 SHA512
    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks