General

  • Target

    782932c480a9a9496041a0690ab3ecd7

  • Size

    80KB

  • Sample

    240126-xvxmmscdg3

  • MD5

    782932c480a9a9496041a0690ab3ecd7

  • SHA1

    6f85216f09fc058d10ee4a6285011cdbfd3f9007

  • SHA256

    8a309de916c457568c0063354150ffcee7ee2654f00a77f269db63d27a9dbe2b

  • SHA512

    46cc544589f2993714ad14b6d63ec748ac6f86fe90f750078476daa8efd26b3c8148a5a9a68b882b6c027043e9e597f81ba02d7b101c0765beceba0b87ae9468

  • SSDEEP

    1536:6JSI5lpk64292nwUcbdhwOqbi1IrpNPKavAlAXsqVIBIA:WSOSnwUcbdqxbesShlAXJS

Malware Config

Extracted

Family

xtremerat

C2

wer99.no-ip.org

Targets

    • Target

      782932c480a9a9496041a0690ab3ecd7

    • Size

      80KB

    • MD5

      782932c480a9a9496041a0690ab3ecd7

    • SHA1

      6f85216f09fc058d10ee4a6285011cdbfd3f9007

    • SHA256

      8a309de916c457568c0063354150ffcee7ee2654f00a77f269db63d27a9dbe2b

    • SHA512

      46cc544589f2993714ad14b6d63ec748ac6f86fe90f750078476daa8efd26b3c8148a5a9a68b882b6c027043e9e597f81ba02d7b101c0765beceba0b87ae9468

    • SSDEEP

      1536:6JSI5lpk64292nwUcbdhwOqbi1IrpNPKavAlAXsqVIBIA:WSOSnwUcbdqxbesShlAXJS

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks