xtremerat

General

Target

df881871142ccf07a768f25996098615
Size

1.2MB
Sample

240326-s8dpgage5y
MD5

df881871142ccf07a768f25996098615
SHA1

bd5d1f2d7cb6c5ff5f5ad55c73a47b23a083c234
SHA256

7e47eeeff1516d19d4bc2e2352b754b3852c1c5d73454f971d45cefebf9811bf
SHA512

1e1edc8c07e56543e796da62f0a10a3acbe17f288827d7e32bc8848643bc2d09630963606f7bdc09ac11bb160ac7fa354ab3e897ee2a220d623b54781d58cdfb
SSDEEP

24576:OFE//Tct4bOsNmAcsHQRxapPg3aO56dZEt4MmZyr6+siYBMpm0q3eTF:kSVNNB2apPg3aO56dZ+45whsiYmpvq3o

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

⮌microsoft.servehttp.com

Targets

- Target
  
  df881871142ccf07a768f25996098615
- Size
  
  1.2MB
- MD5
  
  df881871142ccf07a768f25996098615
- SHA1
  
  bd5d1f2d7cb6c5ff5f5ad55c73a47b23a083c234
- SHA256
  
  7e47eeeff1516d19d4bc2e2352b754b3852c1c5d73454f971d45cefebf9811bf
- SHA512
  
  1e1edc8c07e56543e796da62f0a10a3acbe17f288827d7e32bc8848643bc2d09630963606f7bdc09ac11bb160ac7fa354ab3e897ee2a220d623b54781d58cdfb
- SSDEEP
  
  24576:OFE//Tct4bOsNmAcsHQRxapPg3aO56dZEt4MmZyr6+siYBMpm0q3eTF:kSVNNB2apPg3aO56dZ+45whsiYmpvq3o
Score

10^/10

xtremerat persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Executes dropped EXE

Loads dropped DLL

UPX packed file

Maps connected drives based on registry

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2