General
-
Target
782932c480a9a9496041a0690ab3ecd7
-
Size
80KB
-
Sample
240126-xvxmmscdg3
-
MD5
782932c480a9a9496041a0690ab3ecd7
-
SHA1
6f85216f09fc058d10ee4a6285011cdbfd3f9007
-
SHA256
8a309de916c457568c0063354150ffcee7ee2654f00a77f269db63d27a9dbe2b
-
SHA512
46cc544589f2993714ad14b6d63ec748ac6f86fe90f750078476daa8efd26b3c8148a5a9a68b882b6c027043e9e597f81ba02d7b101c0765beceba0b87ae9468
-
SSDEEP
1536:6JSI5lpk64292nwUcbdhwOqbi1IrpNPKavAlAXsqVIBIA:WSOSnwUcbdqxbesShlAXJS
Behavioral task
behavioral1
Sample
782932c480a9a9496041a0690ab3ecd7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
782932c480a9a9496041a0690ab3ecd7.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
xtremerat
wer99.no-ip.org
Targets
-
-
Target
782932c480a9a9496041a0690ab3ecd7
-
Size
80KB
-
MD5
782932c480a9a9496041a0690ab3ecd7
-
SHA1
6f85216f09fc058d10ee4a6285011cdbfd3f9007
-
SHA256
8a309de916c457568c0063354150ffcee7ee2654f00a77f269db63d27a9dbe2b
-
SHA512
46cc544589f2993714ad14b6d63ec748ac6f86fe90f750078476daa8efd26b3c8148a5a9a68b882b6c027043e9e597f81ba02d7b101c0765beceba0b87ae9468
-
SSDEEP
1536:6JSI5lpk64292nwUcbdhwOqbi1IrpNPKavAlAXsqVIBIA:WSOSnwUcbdqxbesShlAXJS
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-