Overview

overview

10

Static

static

7

715b2f4ff6...4c.exe

windows7-x64

715b2f4ff6...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    715b2f4ff6ffc1dbf997cdca5e05014c.bin

  • Size

    254KB

  • Sample

    240727-csswfstfpa

  • MD5

    715b2f4ff6ffc1dbf997cdca5e05014c

  • SHA1

    8623d032ef652736e0b12100a9b41a1a3f1ba1c9

  • SHA256

    460e8b4e5244700ee4529b840251edf89ce173fda6460ec9a44936a0546387d4

  • SHA512

    29c4db5cfdca57c8641978a767c9b0a34848bed0e6ca758a4a58a04e2e9aa115ca010945aa76bfe983b4fa1e31e8e4dc07e83895bfa0c414390e5c5c63043887

  • SSDEEP

    6144:ZBIj6f6ZnW1Tl2hwJT/u+51PVljjxCCfnXouoh:jIjTnWTf/v51PrHAAX5e

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      715b2f4ff6ffc1dbf997cdca5e05014c.bin

    • Size

      254KB

    • MD5

      715b2f4ff6ffc1dbf997cdca5e05014c

    • SHA1

      8623d032ef652736e0b12100a9b41a1a3f1ba1c9

    • SHA256

      460e8b4e5244700ee4529b840251edf89ce173fda6460ec9a44936a0546387d4

    • SHA512

      29c4db5cfdca57c8641978a767c9b0a34848bed0e6ca758a4a58a04e2e9aa115ca010945aa76bfe983b4fa1e31e8e4dc07e83895bfa0c414390e5c5c63043887

    • SSDEEP

      6144:ZBIj6f6ZnW1Tl2hwJT/u+51PVljjxCCfnXouoh:jIjTnWTf/v51PrHAAX5e

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks