General
-
Target
8c7c8d29ee5176806eed739255953163
-
Size
188KB
-
Sample
240203-q5bdtsdcfm
-
MD5
8c7c8d29ee5176806eed739255953163
-
SHA1
5f8fd5a3f7084af0d0c470b5eb3ed7dea2534360
-
SHA256
799e0c21603e2aee9b0363d70b91c86771079a2da362aa37631756986e409247
-
SHA512
ac36159ebdf0e8fad0f94f2f1d7ae3bb901427fb04ada9a3e9af2d0cea36727f3c1d396a12f667639ac1cb6459309c56fda68634d0e5f5af613b21e140c492a9
-
SSDEEP
3072:KbFHNyEnLhNwhS54L+6J5eAJcKsYOV18fo0sgI1u+aJ:+NyEnLh0X6icXYOVKfo0K4
Static task
static1
Behavioral task
behavioral1
Sample
8c7c8d29ee5176806eed739255953163.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c7c8d29ee5176806eed739255953163.exe
Resource
win10v2004-20231222-en
Malware Config
Targets
-
-
Target
8c7c8d29ee5176806eed739255953163
-
Size
188KB
-
MD5
8c7c8d29ee5176806eed739255953163
-
SHA1
5f8fd5a3f7084af0d0c470b5eb3ed7dea2534360
-
SHA256
799e0c21603e2aee9b0363d70b91c86771079a2da362aa37631756986e409247
-
SHA512
ac36159ebdf0e8fad0f94f2f1d7ae3bb901427fb04ada9a3e9af2d0cea36727f3c1d396a12f667639ac1cb6459309c56fda68634d0e5f5af613b21e140c492a9
-
SSDEEP
3072:KbFHNyEnLhNwhS54L+6J5eAJcKsYOV18fo0sgI1u+aJ:+NyEnLh0X6icXYOVKfo0K4
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-