Overview

overview

10

Static

static

10

7110ce6f0b...a7.exe

windows7-x64

10

7110ce6f0b...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7110ce6f0bf693feaf38393c20d8ab1c0fd9f152310bf4c14ac6f7447b701fa7

  • Size

    44KB

  • Sample

    240515-3ep6hshg86

  • MD5

    7412c143fa5d3c5f2e9be2de2461299b

  • SHA1

    c49eddab1e8acc3c2c07617c3aee280c5f1dc59b

  • SHA256

    7110ce6f0bf693feaf38393c20d8ab1c0fd9f152310bf4c14ac6f7447b701fa7

  • SHA512

    dd8048b1e70998bdd66ab391f3cb2d0a873d39c42066efe7b4ffd301247381ec639c73db58743b840774eda6ebabd4063159bee38aa6c43df0f85f007e83ba09

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIQzoAZyJ:FyRUHlrL1lr6an3TLuvm2buQ4oAZyJ

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      7110ce6f0bf693feaf38393c20d8ab1c0fd9f152310bf4c14ac6f7447b701fa7

    • Size

      44KB

    • MD5

      7412c143fa5d3c5f2e9be2de2461299b

    • SHA1

      c49eddab1e8acc3c2c07617c3aee280c5f1dc59b

    • SHA256

      7110ce6f0bf693feaf38393c20d8ab1c0fd9f152310bf4c14ac6f7447b701fa7

    • SHA512

      dd8048b1e70998bdd66ab391f3cb2d0a873d39c42066efe7b4ffd301247381ec639c73db58743b840774eda6ebabd4063159bee38aa6c43df0f85f007e83ba09

    • SSDEEP

      768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIQzoAZyJ:FyRUHlrL1lr6an3TLuvm2buQ4oAZyJ

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks