xtremerat | 017cad0755b17e8450d1cebdf7eb3d8a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
017cad0755b17e8450d1cebdf7eb3d8a.bin
Size 34KB
Sample240413-bcnfcsca8z
SHA256 72698a5cc68a39003683a7eb67c7a3349858ba6450d5b48cf194577251e25b8c
MD5 961a243970d430851399e78ccd789a1b
SHA1 b0f0aa0517c439169881dec847906e41c4b8df29
SHA512 b015e63b600160d5f68e2b71e63470552294081bac9b8efe7da74e1be6cc06217fb5d3946a7e6292b5c89797d899bea414cb366e89d8c47b1138e6aa4f8e203a
SSDEEP 768:tYf1S+H5kf7axbZHyvaaPd4FxIQJ+oJ6c0uY652nfMr3i0fY7yNw6FEgBCZ2:ef1Sk5t1Hyv/lAJ+26cmW2fMrVCN67
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat

Malware Config

Extracted

Family

xtremerat

net16.net
uriel-productions.net16.n

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
static1/unpack001/e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061.exe	family_xtremerat

Xtremerat family
xtremerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061.exe

File Explorer

017cad0755b17e8450d1cebdf7eb3d8a.bin

.zip 34KB
e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061.exe

.exe 284KB

017cad0755b17e8450d1cebdf7eb3d8a.bin

SHA256 72698a5cc68a39003683a7eb67c7a3349858ba6450d5b48cf194577251e25b8c
MD5 961a243970d430851399e78ccd789a1b
SHA1 b0f0aa0517c439169881dec847906e41c4b8df29
SHA512 b015e63b600160d5f68e2b71e63470552294081bac9b8efe7da74e1be6cc06217fb5d3946a7e6292b5c89797d899bea414cb366e89d8c47b1138e6aa4f8e203a
SSDEEP 768:tYf1S+H5kf7axbZHyvaaPd4FxIQJ+oJ6c0uY652nfMr3i0fY7yNw6FEgBCZ2:ef1Sk5t1Hyv/lAJ+26cmW2fMrVCN67
MD5 SHA1 SHA512 SSDEEP

Password

infected

e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061.exe

SHA256 e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061
MD5 017cad0755b17e8450d1cebdf7eb3d8a
SHA1 6850e39efe52045bb85d2c92934d56de3815ef29
SHA512 ad48a57c9f36940734cd87ffa5884c299c5b71664efbde871d056e0ddd8291b1ff51e396fae938132fe6673bd0e0de105b13348a1ce4f52d8205e252a0510af7
SSDEEP 1536:eT8qnT8qDqQ8K9MK3tGjbNwPZ6oIeXHWFptplIR:kqMyKdcPeXHWFptplIR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect XtremeRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

50788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

017cad0755b17e8450d1cebdf7eb3d8a.bin

e500905dc0d2e2840df0432e54e7820c37d951bf26829b58565bab0d44de7061.exe

generic