xtremerat | c4d9663205caf2f44d082e14debb5571 | Triage

Sharing

General

Target

c4d9663205caf2f44d082e14debb5571
Size

65KB
MD5

c4d9663205caf2f44d082e14debb5571
SHA1

f81640493c457887e35b1b30ba548546ca2349bc
SHA256

84e0ca5e5f7f6fb01336f65c3271bccb0d02682abe93ed63e612fcc1d3059d4e
SHA512

4eaa4205077c56d16d9e7d8fd9599655d7c4a950743a69b98af9a93078261d4cfb463a843a5d68493afc7e677a33166997d515c9f149cb442f3f47418821e87c
SSDEEP

768:d9m1Sq4NQkrBsH1U8z05DeeQuMVTyN8ipHo37Vmd6AeXVtWAJ7A+7voNwOSZLqUj:asq+Q1aZQuIyJp0mgA+FJ0LNwt

Score

10^/10

xtremerat

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
sample	family_xtremerat

Xtremerat family
xtremerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4d9663205caf2f44d082e14debb5571

Files

c4d9663205caf2f44d082e14debb5571
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 203KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ