General
-
Target
b3c7298bcfd539b7e74a169e55017803
-
Size
125KB
-
Sample
240305-e27gbafa64
-
MD5
b3c7298bcfd539b7e74a169e55017803
-
SHA1
eafbb294d99ad22e712b0dd10e1214d4dc980653
-
SHA256
89eb6d8b59331ae386fb085a32b3e2c05b0b0741f0478d0c9ecab1cd21d2d960
-
SHA512
438d27299f900dd46ccb394c24b78a63813cded59cda9370e7b9dc3da86afc3506f0a47cf960836fc26e0f1c2bc829cd517249cc326133480631527e9a3bf2e5
-
SSDEEP
3072:36tbksgGH7NFlG/FRJ1g/+AN+vZuXcsUvE0bf:qtbkmHDliFRrg/2xuXcjxf
Static task
static1
Behavioral task
behavioral1
Sample
b3c7298bcfd539b7e74a169e55017803.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3c7298bcfd539b7e74a169e55017803.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
xtremerat
vvnv12.no-ip.biz
Targets
-
-
Target
b3c7298bcfd539b7e74a169e55017803
-
Size
125KB
-
MD5
b3c7298bcfd539b7e74a169e55017803
-
SHA1
eafbb294d99ad22e712b0dd10e1214d4dc980653
-
SHA256
89eb6d8b59331ae386fb085a32b3e2c05b0b0741f0478d0c9ecab1cd21d2d960
-
SHA512
438d27299f900dd46ccb394c24b78a63813cded59cda9370e7b9dc3da86afc3506f0a47cf960836fc26e0f1c2bc829cd517249cc326133480631527e9a3bf2e5
-
SSDEEP
3072:36tbksgGH7NFlG/FRJ1g/+AN+vZuXcsUvE0bf:qtbkmHDliFRrg/2xuXcjxf
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-