Behavioral task
behavioral1
Sample
9af1f73859028d3b83d19b2fa5da6f0a9b5f279dce89187fd2e4a5b5e5a41f6d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9af1f73859028d3b83d19b2fa5da6f0a9b5f279dce89187fd2e4a5b5e5a41f6d.exe
Resource
win10v2004-20220812-en
General
-
Target
9af1f73859028d3b83d19b2fa5da6f0a9b5f279dce89187fd2e4a5b5e5a41f6d
-
Size
399KB
-
MD5
71af0784211e9904cb45cea2fd09c540
-
SHA1
1813f9d0d696b1fa60b20d3f039df9d7d813f6cf
-
SHA256
9af1f73859028d3b83d19b2fa5da6f0a9b5f279dce89187fd2e4a5b5e5a41f6d
-
SHA512
64a213810da854c068bef542888f105e174313a491085214ef8532db29ef082d7cf1099701453d1adc80d19f3fe1d87b273f5954e2e33a3ac3741580b19af8d7
-
SSDEEP
3072:Sb+W58xl8dBMVYtfZvUCX44rj/Wodmo9o:18MVYtfZUKdm3
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
Files
-
9af1f73859028d3b83d19b2fa5da6f0a9b5f279dce89187fd2e4a5b5e5a41f6d.exe windows x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 38KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 294KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE