xtremerat | 6d0b197c5b4db07c0a1e434c99144ba9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
6d0b197c5b4db07c0a1e434c99144ba9.bin
Size 40KB
Sample240413-bqq4eace5t
SHA256 183fb0c54505c97b59883b71ed75db2aa11429fac6e0c83b47d5f36433836267
MD5 beb9c191b1e7025a22fe757d34f14c67
SHA1 b9f92c5a5e9540ea2bd0ccc24edf1d9d10997043
SHA512 acdecc987384f8ae925829969f5ad80ac5f339f9b5a2ecadfce2434319b2f5830634fe92211d8c4a3ef31574598782c8e2755a17dd945c4b67dc0d5cdba2e485
SSDEEP 768:/aMrFZF03Yq/MtS9swZSKaYgm2xK7Ea4BfkxavH/na1wZCZopwLKb0aV7v5:FFZKYq/Mt4sehuVrBkYv/amZCZopwUVN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx xtremerat

Malware Config

Extracted

Family

xtremerat

hackercool.zapto.org

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
static1/unpack001/2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe	family_xtremerat

Xtremerat family
xtremerat

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe

File Explorer

6d0b197c5b4db07c0a1e434c99144ba9.bin

.zip 40KB
2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe

.exe 309KB

6d0b197c5b4db07c0a1e434c99144ba9.bin

SHA256 183fb0c54505c97b59883b71ed75db2aa11429fac6e0c83b47d5f36433836267
MD5 beb9c191b1e7025a22fe757d34f14c67
SHA1 b9f92c5a5e9540ea2bd0ccc24edf1d9d10997043
SHA512 acdecc987384f8ae925829969f5ad80ac5f339f9b5a2ecadfce2434319b2f5830634fe92211d8c4a3ef31574598782c8e2755a17dd945c4b67dc0d5cdba2e485
SSDEEP 768:/aMrFZF03Yq/MtS9swZSKaYgm2xK7Ea4BfkxavH/na1wZCZopwLKb0aV7v5:FFZKYq/Mt4sehuVrBkYv/amZCZopwUVN
MD5 SHA1 SHA512 SSDEEP

Password

infected

2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe

IMPHASH 70703a9e547c77f1d24bd30aaa4eebf9
SHA256 2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613
MD5 6d0b197c5b4db07c0a1e434c99144ba9
SHA1 d6f959e7382ee28faa3ed2ea01a02368fc581cec
SHA512 f47613029c8d5888790f8a2eb89a610337c639a71ec91d4798a8c7b6180463e445c0d14cc4fb81ccf237f4679886a7988500734b188ed481dec3aaf3b5ecbb20
SSDEEP 1536:ksq+Q1aZQuIyJp0mgA+FJyHdAEAbLWLY:RY8QoQAEJqsLW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect XtremeRAT payload
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

53896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetThreadLocale GetStartupInfoA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA lstrlenW WriteProcessMemory WriteFile WaitForSingleObject VirtualProtectEx VirtualFreeEx VirtualFree VirtualAllocEx VirtualAlloc TerminateThread TerminateProcess Sleep SizeofResource SetThreadPriority SetThreadContext SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile ResumeThread ReadProcessMemory ReadFile LockResource LoadResource LoadLibraryA InitializeCriticalSection GlobalUnlock GlobalSize GlobalLock GetWindowsDirectoryW GetThreadContext GetTempPathW GetSystemDirectoryW GetModuleHandleA GetModuleFileNameW GetLocalTime GetLastError GetFileSize GetFileAttributesW GetCommandLineW FreeResource InterlockedIncrement InterlockedDecrement FindResourceW FindFirstFileW FindClose ExitProcess DeleteFileW DeleteCriticalSection CreateThread CreateRemoteThread CreateProcessW CreateMutexW CreateFileW CreateEventA CreateDirectoryW CopyFileW CloseHandle

user32

GetKeyboardType MessageBoxA CreateWindowExW CreateWindowExA UnregisterClassW UnregisterClassA UnhookWindowsHookEx TranslateMessage ShowWindow SetWindowsHookExW SetWindowLongA SetClipboardViewer SendMessageA RegisterWindowMessageW RegisterClassW RegisterClassA PostMessageA PeekMessageA OpenClipboard MapVirtualKeyW GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowLongA GetMessageA GetKeyboardLayout GetKeyState GetForegroundWindow GetDesktopWindow GetClipboardData GetClassInfoA DispatchMessageA DefWindowProcA CloseClipboard CharUpperW CharNextW CharLowerW CallNextHookEx GetKeyboardState ToUnicodeEx

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

shlwapi

SHDeleteKeyW SHDeleteValueW SHDeleteKeyW

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetMalloc FindExecutableW ShellExecuteW

ntdll

NtUnmapViewOfSection