Behavioral task
behavioral1
Sample
NEAS.b05a045e36a6d25fa9af6f6398906750.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b05a045e36a6d25fa9af6f6398906750.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b05a045e36a6d25fa9af6f6398906750.exe
-
Size
84KB
-
MD5
b05a045e36a6d25fa9af6f6398906750
-
SHA1
4755e6530ffe6b7f2445a18d042bcfb0e5c8eec9
-
SHA256
ef5765ab429d3abf3c51e615f1a7f1e0c3d43765f270096dd199ede3f08cdf83
-
SHA512
e62efaceeeda294720b8c2084b8002ce4d55a3504942205115f26aed992783ffdb427ee78a217e9d56cbb3572d076df73001bdfc3c85fbd2f4de50b167dde33d
-
SSDEEP
768:cZfuHUkE9hghdN12Ozhiow2Gkm6+c3/80lD925zo4fZOp69ug:cBzku+zMOlw2GkmS3N92Ro4m+u
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b05a045e36a6d25fa9af6f6398906750.exe
Files
-
NEAS.b05a045e36a6d25fa9af6f6398906750.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE