xtremerat | c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f

Sharing

Copy URL Twitter E-mail

General

Target
c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
Size 19KB
Sample221014-lxedasabe9
SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
static1/unpack001/out.upx	family_xtremerat

Xtremerat family
xtremerat

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f

.exe 19KB
out.upx

.exe 40KB

c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f

SHA256 c8a6449f1ccfe645430a13fa4185bbd15b13fbdee0c68de06abd1b1749d9508f
MD5 6dd6a31b71bb9209ea003177a6437f68
SHA1 4a9a0e9070bfc366202220254e5cdc21ddb88ff0
SHA512 1ec4d588e04453cd88907a9806b1c0c521be855b0b86183496c8beb217bd68936a842ef3e8617636aad212b152ead0f2404a3a801393d8abd51d3b405b62a54a
SSDEEP 384:RHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSgdo7xIBy7R:UZfuHUvwDKP6kMpbdIoE
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

78416

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 a93c8134e7352b50f6586a8b0a06129ee322edaed26504b48909c2050445ba26
MD5 8d1ef3388f79ce56b53628f463687c38
SHA1 edeb45bd6d08563365dbb52aec4fcd30bdab953e
SHA512 4aaae379c9a394dece81dad0f88acda263aea5866f3d773e0e75acc8cb17e1e46aa0d1ef86b2dbf021fea0a0350e04359ce43e3c6375d25997105c6085d52934
SSDEEP 384:Ez+bK6XiDrNh2tcEn3RdNtnR7qeDjL2O+0nh5I1awK1yPkoJdGtb+/52rr3Z93Bw:DE9hghdN12Ozhiow2Gkm6+c3/fw
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect XtremeRAT payload
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

32068

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ