Overview

overview

10

Static

static

4adbe2d653...d2.exe

windows7_x64

10

4adbe2d653...d2.exe

windows10-2004_x64

10

Resubmissions

11-08-2022 15:42

220811-s5lkxabda5 10

12-07-2022 11:51

220712-n1lynaghdr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

  • Size

    886KB

  • Sample

    220712-n1lynaghdr

  • MD5

    40eaca541433514a31508b7a328db6ef

  • SHA1

    bca267e3a5007147c9c0cb44612bf6027b47ba76

  • SHA256

    4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

  • SHA512

    3fa774f21f13b349e3474ba6da9d0835151d31847f2051f731d24a71e8e6b66be0d35d495b4db9bed7f1697c55533c141b2b70f8d94d53d3e7b50e6cc9ffbf24

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

    • Size

      886KB

    • MD5

      40eaca541433514a31508b7a328db6ef

    • SHA1

      bca267e3a5007147c9c0cb44612bf6027b47ba76

    • SHA256

      4adbe2d65372183b94331aa85fbc68fd11c1031a36f316c8fe07e226f04651d2

    • SHA512

      3fa774f21f13b349e3474ba6da9d0835151d31847f2051f731d24a71e8e6b66be0d35d495b4db9bed7f1697c55533c141b2b70f8d94d53d3e7b50e6cc9ffbf24

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks