xtremerat | a783fe9088399545865c934634765ec8

Sharing

Copy URL Twitter E-mail

General

Target
a783fe9088399545865c934634765ec8
Size 65KB
Sample240226-2et9ssaa28
SHA256 9345b6c2d11f1680a1d1c0abaeff488befa1fb12e4fc70f10aa3adc6168e24d9
MD5 a783fe9088399545865c934634765ec8
SHA1 42dee18d344e697bfbef333d77a3bc1d1366c0c2
SHA512 5f65fd87a16c51dfc3778a634d50b8f39650105ed3342f7d122d69bd4684cde5a216b7a6a21ffdc9dfbc44fa546e1bf8b52be41d49186a3b0b94b5a652c49e71
SSDEEP 768:i8m1Sq4NQErBsH19zoisBKQI6dObAG/dq8uW29Ifnce/yyR+P2ujfgiZKPA+7XoV:Qsq+QVMrObAdXWpf7y47ozNwiUoh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a783fe9088399545865c934634765ec8

File Explorer

a783fe9088399545865c934634765ec8

.exe 65KB

a783fe9088399545865c934634765ec8

SHA256 9345b6c2d11f1680a1d1c0abaeff488befa1fb12e4fc70f10aa3adc6168e24d9
MD5 a783fe9088399545865c934634765ec8
SHA1 42dee18d344e697bfbef333d77a3bc1d1366c0c2
SHA512 5f65fd87a16c51dfc3778a634d50b8f39650105ed3342f7d122d69bd4684cde5a216b7a6a21ffdc9dfbc44fa546e1bf8b52be41d49186a3b0b94b5a652c49e71
SSDEEP 768:i8m1Sq4NQErBsH19zoisBKQI6dObAG/dq8uW29Ifnce/yyR+P2ujfgiZKPA+7XoV:Qsq+QVMrObAdXWpf7y47ozNwiUoh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect XtremeRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53492

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

208KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a783fe9088399545865c934634765ec8

generic