Overview

overview

10

Static

static

3

dfd809f1ed...5c.exe

windows7-x64

10

dfd809f1ed...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfd809f1edaf4727e7431eca0d74865c

  • Size

    272KB

  • Sample

    240326-xdxlbahc73

  • MD5

    dfd809f1edaf4727e7431eca0d74865c

  • SHA1

    1ff57127ac9144345fd792629e636ad325f4b416

  • SHA256

    00171632f54e64b5d0ff8b78867e7a53b50def7cb06639d5f6e5e8bdae39eeaa

  • SHA512

    ea91ba63670ffa76471814d553232ae1e88983a94b51766c26ab185f868cd98c5ec47e3114ad255829a4eb7add426764d3fd03b2e02430b1afb8e32ef436ab92

  • SSDEEP

    6144:gMauJeqN2l9oCTzZzx2D49gPa9/iP5XBJrLfsLt:q3qNEBlcQoLxLELt

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

alssm.no-ip.biz

Targets

    • Target

      dfd809f1edaf4727e7431eca0d74865c

    • Size

      272KB

    • MD5

      dfd809f1edaf4727e7431eca0d74865c

    • SHA1

      1ff57127ac9144345fd792629e636ad325f4b416

    • SHA256

      00171632f54e64b5d0ff8b78867e7a53b50def7cb06639d5f6e5e8bdae39eeaa

    • SHA512

      ea91ba63670ffa76471814d553232ae1e88983a94b51766c26ab185f868cd98c5ec47e3114ad255829a4eb7add426764d3fd03b2e02430b1afb8e32ef436ab92

    • SSDEEP

      6144:gMauJeqN2l9oCTzZzx2D49gPa9/iP5XBJrLfsLt:q3qNEBlcQoLxLELt

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks