Overview

overview

10

Static

static

3

e1279c4e8e...c8.exe

windows7-x64

10

e1279c4e8e...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1279c4e8eafe5c191cf7adcd73bb3c8

  • Size

    726KB

  • Sample

    240327-jn1h3aag61

  • MD5

    e1279c4e8eafe5c191cf7adcd73bb3c8

  • SHA1

    72acfe8bd605874a94d20b3c14f82344acbe32e4

  • SHA256

    089c759fd8d790be19ddaf0fdb2ab57eb09d5886a0f6a178d681debdae77a561

  • SHA512

    bae3e3cb59f15f149ba2f8157853eb4e24ce7a171e30bad8f1d508fe8ae9c04c4f64a2c7fe89392e706b1ead99e05873c3feb9e81c85b545f0853814800a7e79

  • SSDEEP

    12288:c4cOMK2D0y4kS1QzEGxbTS2tWqYeFQ7vi7xEE+J6bCkx+xwPaDiTui2m5MkC1hnc:AY2D0yCGxbW2tWqbFP+J6bPOLxm5MDvc

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Extracted

Family

xtremerat

C2

franco1.no-ip.org

Targets

    • Target

      e1279c4e8eafe5c191cf7adcd73bb3c8

    • Size

      726KB

    • MD5

      e1279c4e8eafe5c191cf7adcd73bb3c8

    • SHA1

      72acfe8bd605874a94d20b3c14f82344acbe32e4

    • SHA256

      089c759fd8d790be19ddaf0fdb2ab57eb09d5886a0f6a178d681debdae77a561

    • SHA512

      bae3e3cb59f15f149ba2f8157853eb4e24ce7a171e30bad8f1d508fe8ae9c04c4f64a2c7fe89392e706b1ead99e05873c3feb9e81c85b545f0853814800a7e79

    • SSDEEP

      12288:c4cOMK2D0y4kS1QzEGxbTS2tWqYeFQ7vi7xEE+J6bCkx+xwPaDiTui2m5MkC1hnc:AY2D0yCGxbW2tWqbFP+J6bPOLxm5MDvc

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks