Overview

overview

10

Static

static

3

4d0970ecb7...fa.exe

windows7-x64

10

4d0970ecb7...fa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4d0970ecb7da2690aa9e65d37cd405fa

  • Size

    104KB

  • Sample

    231226-c3jqjaaha6

  • MD5

    4d0970ecb7da2690aa9e65d37cd405fa

  • SHA1

    55cb0d1dad7d6f87255eb401227a2826dd4f6e42

  • SHA256

    55fc5a58eafe06777bf0063572259ad6d83a43834d6acd32a4230b4f8d8302d7

  • SHA512

    0447624d21bd93e13ac703247315068b17016fb433b04805f99b22c7e258bfa71fa482e8b2811db47e8f2ae1f90184ad3259b76d2136f06051fdfc4083252816

  • SSDEEP

    3072:FN2nGADQVDV4+P8xVQ7FSAhyBrSLwPHnWh6mOhoY2:nVDV4CMVQ7FThGHWh6mJY

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Targets

    • Target

      4d0970ecb7da2690aa9e65d37cd405fa

    • Size

      104KB

    • MD5

      4d0970ecb7da2690aa9e65d37cd405fa

    • SHA1

      55cb0d1dad7d6f87255eb401227a2826dd4f6e42

    • SHA256

      55fc5a58eafe06777bf0063572259ad6d83a43834d6acd32a4230b4f8d8302d7

    • SHA512

      0447624d21bd93e13ac703247315068b17016fb433b04805f99b22c7e258bfa71fa482e8b2811db47e8f2ae1f90184ad3259b76d2136f06051fdfc4083252816

    • SSDEEP

      3072:FN2nGADQVDV4+P8xVQ7FSAhyBrSLwPHnWh6mOhoY2:nVDV4CMVQ7FThGHWh6mJY

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks