Overview

overview

10

Static

static

fdc490c082...b2.exe

windows7-x64

10

fdc490c082...b2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fdc490c082417240b00cfd7d0d29a8d95631dc4486effde6bdf23c69edd22fb2

  • Size

    253KB

  • Sample

    221206-l3x3labb7s

  • MD5

    a26f588418b87e5baa1397c37845bcce

  • SHA1

    5c727bac9ed68e1fd7f3079d8ca3e473b8cdafd7

  • SHA256

    fdc490c082417240b00cfd7d0d29a8d95631dc4486effde6bdf23c69edd22fb2

  • SHA512

    39e378b07260a2b78f34c0b1489fd861a7b15b8d776dcfdf67fb550f3a4db2a6f40f7ba82f4a914ec86197640bf7fce3039fdaa6f1ec063f9ebe65800fe6ecc8

  • SSDEEP

    3072:nGVPohYkQr0jeLwJr95lJoafrjQMfiJNhYkQr0jeLwJr95b2gmLNkgnwm4:JYQqLwhHlWaTjQwidYQqLwhHSyS4

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Targets

    • Target

      fdc490c082417240b00cfd7d0d29a8d95631dc4486effde6bdf23c69edd22fb2

    • Size

      253KB

    • MD5

      a26f588418b87e5baa1397c37845bcce

    • SHA1

      5c727bac9ed68e1fd7f3079d8ca3e473b8cdafd7

    • SHA256

      fdc490c082417240b00cfd7d0d29a8d95631dc4486effde6bdf23c69edd22fb2

    • SHA512

      39e378b07260a2b78f34c0b1489fd861a7b15b8d776dcfdf67fb550f3a4db2a6f40f7ba82f4a914ec86197640bf7fce3039fdaa6f1ec063f9ebe65800fe6ecc8

    • SSDEEP

      3072:nGVPohYkQr0jeLwJr95lJoafrjQMfiJNhYkQr0jeLwJr95b2gmLNkgnwm4:JYQqLwhHlWaTjQwidYQqLwhHSyS4

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks