Overview

overview

10

Static

static

3

dddbc5f2a2...41.exe

windows7-x64

10

dddbc5f2a2...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dddbc5f2a2556e44136710c813dd3b41

  • Size

    900KB

  • Sample

    240325-m7k49sgh7v

  • MD5

    dddbc5f2a2556e44136710c813dd3b41

  • SHA1

    3907e287b54ac1b78e8a2d6c9ba64d62eddd6f67

  • SHA256

    9ff4325114e6ce38666b2e9db383417254c0e9764201cde5fa54d6f9f9d13add

  • SHA512

    3002735f316fb64d3f1e30d7c7703d0b9249c449656603e868ca0d5577ef9746204bb75b8272738db77e3bb01139c1a879b48d85586be98b74c64a9f3d84b236

  • SSDEEP

    24576:YY2D0yCGxbW2tWqbFP+J6bPOLxm5MDvnDKlU7ca1JtO:CDbbWOWqbFPK6bPUD7Bz16

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Extracted

Family

xtremerat

C2

franco1.no-ip.org

Targets

    • Target

      dddbc5f2a2556e44136710c813dd3b41

    • Size

      900KB

    • MD5

      dddbc5f2a2556e44136710c813dd3b41

    • SHA1

      3907e287b54ac1b78e8a2d6c9ba64d62eddd6f67

    • SHA256

      9ff4325114e6ce38666b2e9db383417254c0e9764201cde5fa54d6f9f9d13add

    • SHA512

      3002735f316fb64d3f1e30d7c7703d0b9249c449656603e868ca0d5577ef9746204bb75b8272738db77e3bb01139c1a879b48d85586be98b74c64a9f3d84b236

    • SSDEEP

      24576:YY2D0yCGxbW2tWqbFP+J6bPOLxm5MDvnDKlU7ca1JtO:CDbbWOWqbFPK6bPUD7Bz16

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks