Overview

overview

10

Static

static

7

715b2f4ff6...4c.exe

windows7-x64

715b2f4ff6...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    715b2f4ff6ffc1dbf997cdca5e05014c.bin

  • Size

    254KB

  • Sample

    240727-csswfstfpa

  • MD5

    715b2f4ff6ffc1dbf997cdca5e05014c

  • SHA1

    8623d032ef652736e0b12100a9b41a1a3f1ba1c9

  • SHA256

    460e8b4e5244700ee4529b840251edf89ce173fda6460ec9a44936a0546387d4

  • SHA512

    29c4db5cfdca57c8641978a767c9b0a34848bed0e6ca758a4a58a04e2e9aa115ca010945aa76bfe983b4fa1e31e8e4dc07e83895bfa0c414390e5c5c63043887

  • SSDEEP

    6144:ZBIj6f6ZnW1Tl2hwJT/u+51PVljjxCCfnXouoh:jIjTnWTf/v51PrHAAX5e

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      715b2f4ff6ffc1dbf997cdca5e05014c.bin

    • Size

      254KB

    • MD5

      715b2f4ff6ffc1dbf997cdca5e05014c

    • SHA1

      8623d032ef652736e0b12100a9b41a1a3f1ba1c9

    • SHA256

      460e8b4e5244700ee4529b840251edf89ce173fda6460ec9a44936a0546387d4

    • SHA512

      29c4db5cfdca57c8641978a767c9b0a34848bed0e6ca758a4a58a04e2e9aa115ca010945aa76bfe983b4fa1e31e8e4dc07e83895bfa0c414390e5c5c63043887

    • SSDEEP

      6144:ZBIj6f6ZnW1Tl2hwJT/u+51PVljjxCCfnXouoh:jIjTnWTf/v51PrHAAX5e

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks