xtremerat | 91f5643ac9cd8671b06bb4125edf2cb4

Sharing

Copy URL Twitter E-mail

General

Target
91f5643ac9cd8671b06bb4125edf2cb4
Size 637KB
Sample240205-pbwbgafcg8
SHA256 7c82825dfbdb907cfea83129932d0ec60506e01a8aa6f617c553da3ee2a26951
MD5 91f5643ac9cd8671b06bb4125edf2cb4
SHA1 e968dbb94a547ec927bab4d1a611d7b12662e030
SHA512 8aea4cd64a989f5f47e647076a3d1ff82d7718c069da320d0a2a9e9f494824fca29b9ee44120cc01d2a5017a6364c9e5ee5eb8e6f03e77d732b8e25dd30e70b9
SSDEEP 12288:cHWLQg3SW1f41lxTmVu8sw4X6wy2dNnapYBB:oWcw21l4Vu8sws64qpYBB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91f5643ac9cd8671b06bb4125edf2cb4

File Explorer

91f5643ac9cd8671b06bb4125edf2cb4

.exe 637KB

91f5643ac9cd8671b06bb4125edf2cb4

IMPHASH 4ba7e112858cb8b5f262ec37152a3c70
SHA256 7c82825dfbdb907cfea83129932d0ec60506e01a8aa6f617c553da3ee2a26951
MD5 91f5643ac9cd8671b06bb4125edf2cb4
SHA1 e968dbb94a547ec927bab4d1a611d7b12662e030
SHA512 8aea4cd64a989f5f47e647076a3d1ff82d7718c069da320d0a2a9e9f494824fca29b9ee44120cc01d2a5017a6364c9e5ee5eb8e6f03e77d732b8e25dd30e70b9
SSDEEP 12288:cHWLQg3SW1f41lxTmVu8sw4X6wy2dNnapYBB:oWcw21l4Vu8sws64qpYBB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect XtremeRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

858549

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetThreadLocale GetStartupInfoA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA lstrlenW WriteProcessMemory WriteFile WaitForSingleObject VirtualProtectEx VirtualFreeEx VirtualFree VirtualAllocEx VirtualAlloc TerminateThread TerminateProcess Sleep SizeofResource SetThreadPriority SetThreadContext SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile ResumeThread ReadProcessMemory ReadFile LockResource LoadResource LoadLibraryA InitializeCriticalSection GlobalUnlock GlobalSize GlobalLock GetWindowsDirectoryW GetThreadContext GetTempPathW GetSystemDirectoryW GetModuleHandleA GetModuleFileNameW GetLocalTime GetLastError GetFileSize GetFileAttributesW GetCommandLineW FreeResource InterlockedIncrement InterlockedDecrement FindResourceW FindFirstFileW FindClose ExitProcess DeleteFileW DeleteCriticalSection CreateThread CreateRemoteThread CreateProcessW CreateMutexW CreateFileW CreateEventA CreateDirectoryW CopyFileW CloseHandle InitializeCriticalSection GetModuleFileNameW GetModuleHandleW TerminateProcess GetCurrentProcess DeleteCriticalSection LoadLibraryW CreateEventW CompareStringW SetLastError GetModuleHandleA VirtualProtect GetTickCount EnterCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc WriteProcessMemory CreateToolhelp32Snapshot GetCurrentProcessId GetCurrentThreadId Thread32First OpenThread Thread32Next CloseHandle SuspendThread ResumeThread GetSystemInfo FreeLibrary LoadResource MultiByteToWideChar WideCharToMultiByte FindResourceExW FindResourceExA GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW GetSystemTime GetLocalTime SystemTimeToFileTime CompareFileTime GetCommandLineA GetLastError HeapFree HeapAlloc RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc HeapSize LoadLibraryA GetLocaleInfoA RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount VirtualQuery GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetKeyboardType MessageBoxA CreateWindowExW CreateWindowExA UnregisterClassW UnregisterClassA UnhookWindowsHookEx TranslateMessage ShowWindow SetWindowsHookExW SetWindowLongA SetClipboardViewer SendMessageA RegisterWindowMessageW RegisterClassW RegisterClassA PostMessageA PeekMessageA OpenClipboard MapVirtualKeyW GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowLongA GetMessageA GetKeyboardLayout GetKeyState GetForegroundWindow GetDesktopWindow GetClipboardData GetClassInfoA DispatchMessageA DestroyWindow DefWindowProcA CloseClipboard CharUpperW CharNextW CharLowerW CallNextHookEx GetKeyboardState ToUnicodeEx MessageBoxW CharUpperBuffW wsprintfW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

shlwapi

SHDeleteKeyW SHDeleteValueW SHDeleteKeyW

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetMalloc FindExecutableW ShellExecuteW

urlmon

URLDownloadToCacheFileW

wininet

InternetCloseHandle FtpPutFileW FtpSetCurrentDirectoryW InternetOpenW InternetConnectW

ntdll

NtUnmapViewOfSection

Name

CODE

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

208KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

545KB

Virtual Size

544KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

91f5643ac9cd8671b06bb4125edf2cb4

kernel32

user32

advapi32

oleaut32

shlwapi

shell32

urlmon

wininet

ntdll

generic