Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

  • Size

    585KB

  • Sample

    221003-s886dadec7

  • MD5

    55c0e0fb391a3ce4caaac1c49ed1ac00

  • SHA1

    868da3a8c72eff600d54be3babe3721489a85500

  • SHA256

    4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

  • SHA512

    60a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1

  • SSDEEP

    12288:Za7XtTWupXNT35AcFqTCC5ktTWupXNT35AcFqTCC5I:ZEhZpXJ3SGqTCCuhZpXJ3SGqTCCm

Malware Config

Extracted

Family

xtremerat

C2

mrdead.no-ip.org

Targets

    • Target

      4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

    • Size

      585KB

    • MD5

      55c0e0fb391a3ce4caaac1c49ed1ac00

    • SHA1

      868da3a8c72eff600d54be3babe3721489a85500

    • SHA256

      4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d

    • SHA512

      60a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1

    • SSDEEP

      12288:Za7XtTWupXNT35AcFqTCC5ktTWupXNT35AcFqTCC5I:ZEhZpXJ3SGqTCCuhZpXJ3SGqTCCm

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Modifies Installed Components in the registry

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks