xtremerat | 9299b156bfce991d2a144cab3b72d597

Sharing

Copy URL Twitter E-mail

General

Target
9299b156bfce991d2a144cab3b72d597
Size 65KB
Sample240205-v9n8psfbdr
SHA256 a1c0709d2ba24a3a4a664cfccdf33428b7dd6d26feb7f7098e67f0d6bdf40306
MD5 9299b156bfce991d2a144cab3b72d597
SHA1 0fd74b1df2c0c9e01587fb7dd278fd8c73828f64
SHA512 7da49514ff797b28a8eacee486e90b6dff073f02732c738c07a410492fde75d19cf6f11bf3ae7ddafb20f47ce3c3b0ebe1aa8dac6b482a1f20ae60ba3184b389
SSDEEP 768:88m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiXsbs8Hozr:esq+QV4rObAdXWpf/y+YaAoF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9299b156bfce991d2a144cab3b72d597

File Explorer

9299b156bfce991d2a144cab3b72d597

.exe 65KB

9299b156bfce991d2a144cab3b72d597

SHA256 a1c0709d2ba24a3a4a664cfccdf33428b7dd6d26feb7f7098e67f0d6bdf40306
MD5 9299b156bfce991d2a144cab3b72d597
SHA1 0fd74b1df2c0c9e01587fb7dd278fd8c73828f64
SHA512 7da49514ff797b28a8eacee486e90b6dff073f02732c738c07a410492fde75d19cf6f11bf3ae7ddafb20f47ce3c3b0ebe1aa8dac6b482a1f20ae60ba3184b389
SSDEEP 768:88m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiXsbs8Hozr:esq+QV4rObAdXWpf/y+YaAoF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect XtremeRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53492

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

208KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9299b156bfce991d2a144cab3b72d597

generic