General
-
Target
748646a41dbe693c5cf65f9f7e9ae433
-
Size
843KB
-
Sample
240125-m49nfsecf3
-
MD5
748646a41dbe693c5cf65f9f7e9ae433
-
SHA1
9e02c4246cabd557c9539bf46a9b72db301a7c09
-
SHA256
4ed161bd4c36ab1add6bd37374c1276ca59334b693fd28bd95e2cd3f953ccc97
-
SHA512
eed1011e8aaa9d2cb767030c61009c9817988f2bd644df8ca2b81f4e726d394512c2d6c09b1211ed9ee5a82d4872a44ae089868d321ae6d7b318445034cd259c
-
SSDEEP
12288:whkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aFpPF5MEq:4RmJkcoQricOIQxiZY1iaTPFaEq
Static task
static1
Behavioral task
behavioral1
Sample
748646a41dbe693c5cf65f9f7e9ae433.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
748646a41dbe693c5cf65f9f7e9ae433.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
xtremerat
rkt.no-ip.org
Targets
-
-
Target
748646a41dbe693c5cf65f9f7e9ae433
-
Size
843KB
-
MD5
748646a41dbe693c5cf65f9f7e9ae433
-
SHA1
9e02c4246cabd557c9539bf46a9b72db301a7c09
-
SHA256
4ed161bd4c36ab1add6bd37374c1276ca59334b693fd28bd95e2cd3f953ccc97
-
SHA512
eed1011e8aaa9d2cb767030c61009c9817988f2bd644df8ca2b81f4e726d394512c2d6c09b1211ed9ee5a82d4872a44ae089868d321ae6d7b318445034cd259c
-
SSDEEP
12288:whkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aFpPF5MEq:4RmJkcoQricOIQxiZY1iaTPFaEq
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-