xtremerat | 64b6494b1dcf38d8b5b7d38b4eb1b5b1d5fa18c32067d0bd41bebe25c982bf6a

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 05:50

Target
7c4ea05609f368f1e50ca17df26a2473.exe
Size 65KB
Sample240128-gjthvaedej
SHA256 64b6494b1dcf38d8b5b7d38b4eb1b5b1d5fa18c32067d0bd41bebe25c982bf6a
MD5 7c4ea05609f368f1e50ca17df26a2473
SHA1 1e7c181034f1244f75a234be31c9495012629215
SHA512 17f30837dff2e07b9a211ea0a73db53fcbb6975109a04f87bc33ded577d542bd6770bbe6825332f42111f5ea3931c1492748fd290b617a2298d993e8db0d31fe
SSDEEP 1536:esq+QD4rObAdNoAf5UqiYmlArNwWAokAc:PS4rOR1APAoe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4988-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5000	4988	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\7c4ea05609f368f1e50ca17df26a2473.exe
"C:\Users\Admin\AppData\Local\Temp\7c4ea05609f368f1e50ca17df26a2473.exe"
1⤵
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 500
  2⤵
  - Program crash
  PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4988 -ip 4988
1⤵
PID:4252

memory/4988-0-0x0000000010000000-0x000000001004A000-memory.dmp

Download