Static task
static1
Behavioral task
behavioral1
Sample
XtremeShell 4.3 Portable.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XtremeShell 4.3 Portable.exe
Resource
win10v2004-20240802-en
General
-
Target
XtremeShell 4.3 Portable.exe
-
Size
9.1MB
-
MD5
71151b0df6c008855a004b2975e3f822
-
SHA1
a07eb40d7badde7dc462c8a83d648cbdafe36acd
-
SHA256
fc44937657804765aa8a05b2faf58fca83738edcacf9bb3c64770b8fc9cb6a6f
-
SHA512
7daafaebf54ed538e109dd5b71363994967dadcf282cd05b7923a2cc9ca6adff9ba6472332cd44c9a2ee1be77b6793631b78cbd9fda1c6d5bd80ef6d63176963
-
SSDEEP
196608:hXVAqaXa6JfRYmEac7V8QW5oiwDkZUuYGZKQlX8yC3O13:hFANrYmEaCmj5oiwDkO+KdlK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XtremeShell 4.3 Portable.exe
Files
-
XtremeShell 4.3 Portable.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ