xtremerat | 8818750eea5a5285701d6f54eb4891cc6b24f5d976349ad6bfa5fd12453162c0 | Triage

Sharing

General

Target

8818750eea5a5285701d6f54eb4891cc6b24f5d976349ad6bfa5fd12453162c0
Size

60KB
MD5

787bb8548f5f5370ad854c9ae7e8a9cf
SHA1

9ed4c3f0b15970eb0f48ada7f0474cad23faa898
SHA256

8818750eea5a5285701d6f54eb4891cc6b24f5d976349ad6bfa5fd12453162c0
SHA512

d8df22b4537ec9f7cb72129d3899f184ecfb417ceac49eda425d34709cc49e736c46a4c62290a3e7a94d91f13c3299eeec7e80d6321c7128375063f47a56ea90
SSDEEP

768:r8m1Sq4NQErBsH1tzoisBKQI6dObAG/dqOXHsoAx5JXrUqLOY0pYKnA+7PoNw:Dsq+QV4rObAdNoAf5UqiYmlArNw

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Files

8818750eea5a5285701d6f54eb4891cc6b24f5d976349ad6bfa5fd12453162c0
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 208KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc1
Size: - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rvsmldn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE