Behavioral task
behavioral1
Sample
14a1dd2c5c05e1169a9fafb39fc52a80N.exe
Resource
win7-20240704-en
General
-
Target
14a1dd2c5c05e1169a9fafb39fc52a80N.exe
-
Size
384KB
-
MD5
14a1dd2c5c05e1169a9fafb39fc52a80
-
SHA1
ec124102a7a838e8ca56a406e604e645b966e561
-
SHA256
0467df03c2861d8f56525bbb728e464755c1fe12900a09b44b5ca9a88c99debd
-
SHA512
a8b8791280aa40103d49eae48e92d323894dbf96279a9275e68fbb649e445f41a8d6b6b7f8218a250e40101fcbf9535fe1c6b617215ea0123bd70a25a8766f92
-
SSDEEP
3072:xtFoyRUZ7v1ooXQKjVTtFoyRUZ7vWooXQKjV:xrjqZ7tdXHTrjqZ7udXH
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14a1dd2c5c05e1169a9fafb39fc52a80N.exe
Files
-
14a1dd2c5c05e1169a9fafb39fc52a80N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE