General
-
Target
7973962bde4337232e329f225d35a980
-
Size
249KB
-
Sample
240127-gnhbdagbdn
-
MD5
7973962bde4337232e329f225d35a980
-
SHA1
acdf91a400b61110ec383eca393f0cc67249fd27
-
SHA256
b9718c33518e2a310732dcfaee5e3bc3d1613d153bc53cdaf16a71f06bc56e63
-
SHA512
d3930b346eaa3d321efd12fbbc692edf4825036cf1e99bd06047efed5e228ad827db20aa711fd95cb1aa46b57b68a48e3ed6b6add97d637e064e7393dd096ae1
-
SSDEEP
6144:K+hBCkOhXTZqjWTAfXuPN4ePz5s8y16f3Tv6VR/A:okgTZqLfSN4uB7W/A
Static task
static1
Behavioral task
behavioral1
Sample
7973962bde4337232e329f225d35a980.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7973962bde4337232e329f225d35a980.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
xtremerat
maxitrax.serveftp.com
Targets
-
-
Target
7973962bde4337232e329f225d35a980
-
Size
249KB
-
MD5
7973962bde4337232e329f225d35a980
-
SHA1
acdf91a400b61110ec383eca393f0cc67249fd27
-
SHA256
b9718c33518e2a310732dcfaee5e3bc3d1613d153bc53cdaf16a71f06bc56e63
-
SHA512
d3930b346eaa3d321efd12fbbc692edf4825036cf1e99bd06047efed5e228ad827db20aa711fd95cb1aa46b57b68a48e3ed6b6add97d637e064e7393dd096ae1
-
SSDEEP
6144:K+hBCkOhXTZqjWTAfXuPN4ePz5s8y16f3Tv6VR/A:okgTZqLfSN4uB7W/A
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-