xtremerat | 4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc | Triage

Submit
Reports

Overview

overview

Static

static

4475ce64f8...bc.exe

windows7-x64

4475ce64f8...bc.exe

windows10-2004-x64

Sharing

General

Target

4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc
Size

45KB
Sample

221011-kx3kfsfbc7
MD5

7c6b24aa166a8811f2e7d6f705088157
SHA1

00343b5a272e9a65d51a5ab52279d543253dbb92
SHA256

4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc
SHA512

036d7e552d63035bd18e4445ae02388363d70d5c780d5460f2245213625ec0e37dae73b7bc615f2913bde781dc8afa27b631e1ca53b06e3462ace0f21172132c
SSDEEP

768:IE9hghdN12Ozhiow2Gkmi+c3/YBzNBwIldPFXFdo6:Iu+zMOlw2Gkm63sBldVo6

Score

10^/10

xtremerat persistence rat spyware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc.exe

Resource

win7-20220812-en

xtremerat persistence rat spyware

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc.exe

Resource

win10v2004-20220812-en

xtremerat persistence rat spyware

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc
- Size
  
  45KB
- MD5
  
  7c6b24aa166a8811f2e7d6f705088157
- SHA1
  
  00343b5a272e9a65d51a5ab52279d543253dbb92
- SHA256
  
  4475ce64f8a4ce7f1626f97da6a09793563a20b3afe9b19b58fe8d8862f7e0bc
- SHA512
  
  036d7e552d63035bd18e4445ae02388363d70d5c780d5460f2245213625ec0e37dae73b7bc615f2913bde781dc8afa27b631e1ca53b06e3462ace0f21172132c
- SSDEEP
  
  768:IE9hghdN12Ozhiow2Gkmi+c3/YBzNBwIldPFXFdo6:Iu+zMOlw2Gkm63sBldVo6
Score

10^/10

xtremerat persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Modifies Installed Components in the registry
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratpersistenceratspyware

behavioral2

xtremeratpersistenceratspyware

© 2018-2025

Terms | Privacy