Overview

overview

10

Static

static

10

da23d1b2f0...82.exe

windows7-x64

10

da23d1b2f0...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11c99f1dc9225822c1a24069b071d00be0c5455b27f88603e9d5106169ac92cc

  • Size

    39KB

  • Sample

    240417-pw3w2sha5v

  • MD5

    d04e9291a10926188632939fc471113f

  • SHA1

    a75fe61b37a1bf77ad79e84ba4d8026b73a4eefd

  • SHA256

    11c99f1dc9225822c1a24069b071d00be0c5455b27f88603e9d5106169ac92cc

  • SHA512

    ee283e5605ec28af3c45f4b1e5c96caad9bbd3174c27dc295eb539d4e7f3ab2a11d646bcac6a1db42d9ed1dc1eccb4e0bbdb5fdf3184825337bbef67fbf4856f

  • SSDEEP

    768:FG44ya3J9n77j5d429QxfpbbfUTmn/YDEHZsU0ql/zZAHG3j45FaSW9TZoHs:FG4XaZV4OQxRbfUTrDE2EtSr5FSBZ8s

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Extracted

Family

xtremerat

C2

hackercool.zapto.org

Targets

    • Target

      da23d1b2f06e219f028548cc2823aa4c2b251f5513f8502d82337c3acfcd5c82.exe

    • Size

      304KB

    • MD5

      1192821d7e46a8b4ca5a3be98f93c809

    • SHA1

      bfdc242a6ae77af10bb2b3e30d49269767a1a196

    • SHA256

      da23d1b2f06e219f028548cc2823aa4c2b251f5513f8502d82337c3acfcd5c82

    • SHA512

      56878ace9b58f9578f1f875ab935959771213ea1fbfc5a3d5be0f653492c4e05bc41e45e8229d8d96b1e5653b50e7a5831d8e16e6df1df81ad7f72ee4d6a4d5b

    • SSDEEP

      768:K9m1Sq4NQkrBsH1U8z05DeeQuMVTyN8ipHo37Vmd6AeXVtWAJ+BJzv+S3MgyRAR0:nsq+Q1aZQuIyJp0mgA+FJ4LEAbL

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks