xtremerat | af32e7d59c778815276e7ca32535fe9048c80596d59d844876c58a455d9491d8 | Triage

Submit
Reports

Overview

overview

Static

static

3

834ee177dc...18.exe

windows7-x64

834ee177dc...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

834ee177dccb90d586156e4a1596d9e0_JaffaCakes118
Size

612KB
Sample

240802-gvhwgsvcmg
MD5

834ee177dccb90d586156e4a1596d9e0
SHA1

a35079e5ccec35cde48a895c10512e26d68138f1
SHA256

af32e7d59c778815276e7ca32535fe9048c80596d59d844876c58a455d9491d8
SHA512

47f435159a706cfc132a656d61a920ee385cede15bc2ec27b58032f653567555558daed641cdc15b666e30585e3c915d0506783d2bc43bc4798f9984d9cf17e2
SSDEEP

12288:aaoqwuhLcuEQhxkkGsLX4UkaUp77xCgp1spuQuQxOMTMUoAj65+q0jj:aaojuhLcuESLjk7PxT3ZXYMtAs8j

Score

10^/10

xtremerat discovery evasion persistence rat spyware trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

834ee177dccb90d586156e4a1596d9e0_JaffaCakes118.exe

Resource

win7-20240708-en

xtremerat discovery evasion persistence rat spyware trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

834ee177dccb90d586156e4a1596d9e0_JaffaCakes118.exe

Resource

win10v2004-20240730-en

xtremerat discovery evasion persistence rat spyware upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  834ee177dccb90d586156e4a1596d9e0_JaffaCakes118
- Size
  
  612KB
- MD5
  
  834ee177dccb90d586156e4a1596d9e0
- SHA1
  
  a35079e5ccec35cde48a895c10512e26d68138f1
- SHA256
  
  af32e7d59c778815276e7ca32535fe9048c80596d59d844876c58a455d9491d8
- SHA512
  
  47f435159a706cfc132a656d61a920ee385cede15bc2ec27b58032f653567555558daed641cdc15b666e30585e3c915d0506783d2bc43bc4798f9984d9cf17e2
- SSDEEP
  
  12288:aaoqwuhLcuEQhxkkGsLX4UkaUp77xCgp1spuQuQxOMTMUoAj65+q0jj:aaojuhLcuESLjk7PxT3ZXYMtAs8j
Score

10^/10

xtremerat discovery evasion persistence rat spyware trojan upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoveryevasionpersistenceratspywaretrojanupx

behavioral2

xtremeratdiscoveryevasionpersistenceratspywareupx

© 2018-2025

Terms | Privacy