Overview

overview

10

Static

static

3

deeb250003...c3.exe

windows7-x64

10

deeb250003...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deeb2500038e367d8a4baa0ba5b6cdc3

  • Size

    683KB

  • Sample

    240326-ma5gmsag7x

  • MD5

    deeb2500038e367d8a4baa0ba5b6cdc3

  • SHA1

    6850d425a44bbb770800e1e167daad441a4d229b

  • SHA256

    3f6cdddacc5ad8f48bf9afdf228cd7058500f653cbf3466f66e9fca02222d5cc

  • SHA512

    ce69c9b00dd0c77e950466addc1fa17ce65645b099c486e2aa354c5b503b889d5016bacefb4d7d57af725d39e50d0928cbf396f95f989b57808dc1bcd6fed85f

  • SSDEEP

    12288:Mutrzh9xOXki5l1V2SrwDE8b09uDdLqCNQruBLiqawOLB2fm4Yi5Zpi+ZmLbyMvq:Mutr5OUi5l1V26uA9e8CN0KLiveYuZpX

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

baseeem.no-ip.biz

Targets

    • Target

      deeb2500038e367d8a4baa0ba5b6cdc3

    • Size

      683KB

    • MD5

      deeb2500038e367d8a4baa0ba5b6cdc3

    • SHA1

      6850d425a44bbb770800e1e167daad441a4d229b

    • SHA256

      3f6cdddacc5ad8f48bf9afdf228cd7058500f653cbf3466f66e9fca02222d5cc

    • SHA512

      ce69c9b00dd0c77e950466addc1fa17ce65645b099c486e2aa354c5b503b889d5016bacefb4d7d57af725d39e50d0928cbf396f95f989b57808dc1bcd6fed85f

    • SSDEEP

      12288:Mutrzh9xOXki5l1V2SrwDE8b09uDdLqCNQruBLiqawOLB2fm4Yi5Zpi+ZmLbyMvq:Mutr5OUi5l1V26uA9e8CN0KLiveYuZpX

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks