xtremerat | d5f343c90024ae4e5e427b813ab4cb009d12f5bc3d2ff33990418b0bfa76022d | Triage

Submit
Reports

Overview

overview

Static

static

7

f05a02ef61...18.exe

windows7-x64

f05a02ef61...18.exe

windows10-2004-x64

Sharing

General

Target

f05a02ef611cc0db1a64bb859a069497_JaffaCakes118
Size

376KB
Sample

240415-fhe4dshe5x
MD5

f05a02ef611cc0db1a64bb859a069497
SHA1

6f873621db30814be163f4ae3ddf2d71cb8fb2fa
SHA256

d5f343c90024ae4e5e427b813ab4cb009d12f5bc3d2ff33990418b0bfa76022d
SHA512

baa22020e303ab74c737e37c896ef518aecbe8658f120994898ae60912ce8e6dda4ba0d340c97aa4c587fde81a0b4e8f58fbf0f6ed36015dcd45208710892563
SSDEEP

6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59aI3yN5gyNA4:ljkArEN249AyE/rbaMct4bO2/VJyYyz

Score

10^/10

xtremerat persistence rat spyware upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

f05a02ef611cc0db1a64bb859a069497_JaffaCakes118.exe

Resource

win7-20240221-en

xtremerat persistence rat spyware upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

f05a02ef611cc0db1a64bb859a069497_JaffaCakes118.exe

Resource

win10v2004-20240412-en

xtremerat persistence rat spyware upx

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

xtremerat

C2

123vivalgerie.no-ip.biz

ƶallgeriaa.zapto.org

getdesktoppreviewinfo|130mahdidi.zapto.org

ƶ123vivalgerie.no-ip.biz

Targets

- Target
  
  f05a02ef611cc0db1a64bb859a069497_JaffaCakes118
- Size
  
  376KB
- MD5
  
  f05a02ef611cc0db1a64bb859a069497
- SHA1
  
  6f873621db30814be163f4ae3ddf2d71cb8fb2fa
- SHA256
  
  d5f343c90024ae4e5e427b813ab4cb009d12f5bc3d2ff33990418b0bfa76022d
- SHA512
  
  baa22020e303ab74c737e37c896ef518aecbe8658f120994898ae60912ce8e6dda4ba0d340c97aa4c587fde81a0b4e8f58fbf0f6ed36015dcd45208710892563
- SSDEEP
  
  6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59aI3yN5gyNA4:ljkArEN249AyE/rbaMct4bO2/VJyYyz
Score

10^/10

xtremerat persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

xtremeratpersistenceratspywareupx

behavioral2

xtremeratpersistenceratspywareupx

© 2018-2024

Terms | Privacy