Overview

overview

10

Static

static

3

Crysis2_v1...er.exe

windows7-x64

10

Crysis2_v1...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8954e713d470bf5e5e2d70e4a909eff9_JaffaCakes118

  • Size

    131KB

  • Sample

    240811-g53cwasejd

  • MD5

    8954e713d470bf5e5e2d70e4a909eff9

  • SHA1

    698130f13693bfa4e2ae6d11f2c80e4304393bec

  • SHA256

    d52a85c79b6063fe69276eb6b63a43b767de7eed0fa5b35968ebc46ff88f51dc

  • SHA512

    ad0f0add10d562f3143d65bfad17408ec55ed7f5195d83a5c7250dac2fc4c7c8b16e3ee4eb4e7551d5295615cd7e23025c9805ef79e6743e743a20b8e3a2c18a

  • SSDEEP

    3072:I6NQSQKywEdN5LLpTCpf4zcugG3gVYhGWtiyn9ceSj83/t:I6WSQNbvZNCvAsWtiy98wvt

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

ᠼhoshx.no-ip.org

c_209hoshx.no-ip.org

Targets

    • Target

      Crysis2_v1-9_Trainer/Crysis2_v1-9_Trainer.exe

    • Size

      102KB

    • MD5

      731c9c3d522ecf0538815e35577dd373

    • SHA1

      c075a1e83284924aea80add9023922f5bd7b2ebc

    • SHA256

      51af50494be139e4f2e9efa19501918aff117f6ef2fe0451f62457006117abc2

    • SHA512

      7e4d92717a9a801e4c100a4dac689a8393058cef0e9438a5506b774748ed84164b5ae1c88624cd9ccb0302bd9b9cd18cc384f36948fc2f65c5303c54c9447c13

    • SSDEEP

      3072:m5LLpTCpf4zcugG3gVYhGWtiyn9ceSj83/U:mZNCvAsWtiy98wvU

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks