xtremerat | c0dc3933daf6612dc3b926e39ca46940d5f45d62750e3019311e897ce7de92ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0dc3933daf6612dc3b926e39ca46940d5f45d62750e3019311e897ce7de92ed
Size

158KB
MD5

dc15ba900db72231f33926881f4f9673
SHA1

2226c2c02e6fedab7d2e2779c67e4981ea9916c4
SHA256

c0dc3933daf6612dc3b926e39ca46940d5f45d62750e3019311e897ce7de92ed
SHA512

ae2dd5c781bc19285a0fd75d1e66b17c382d51946ddc72187980133b2bfe4648aa913f24e59b61cbcbc53508375051577876b648b073102ef8163f1bc735e21a
SSDEEP

1536:3sq+QV4rObAdXWpfKyhcz97qjh3rmKPNIoT:644rjkezojZqMNIoT

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Files

c0dc3933daf6612dc3b926e39ca46940d5f45d62750e3019311e897ce7de92ed
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 208KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 17B

IMAGE_SCN_MEM_READ

.
Size: 4KB - Virtual size: 3KB

Size: 34KB - Virtual size: 33KB

IMAGE_SCN_MEM_READ