xtremerat

General

Target

ea5b81ef79adb077ed832aae119fb0be_JaffaCakes118
Size

344KB
Sample

240919-b4nkfavarj
MD5

ea5b81ef79adb077ed832aae119fb0be
SHA1

85078dda8bfe43db70d3cc85fb877a1fa5132f33
SHA256

40fda4ca6342e7bff03b1a55cf1414b9099b86a4beab4a65eedfdc98103c388d
SHA512

4a7783ffd50a669cc58b4b9d518648f8e4bfdb6399b555b231a5f0695c7d69aaad4b6ee28878e63e204d26a86818429b6d98647fa52586b87c3d18b180caf92d
SSDEEP

6144:SNW7mvIZNC7rGN3bkty0Mki8787O71rkhJSammcmZq:QW7SIa7rGNrkty0fkhAlmvq

Score

10^/10

Malware Config

Targets

- Target
  
  ea5b81ef79adb077ed832aae119fb0be_JaffaCakes118
- Size
  
  344KB
- MD5
  
  ea5b81ef79adb077ed832aae119fb0be
- SHA1
  
  85078dda8bfe43db70d3cc85fb877a1fa5132f33
- SHA256
  
  40fda4ca6342e7bff03b1a55cf1414b9099b86a4beab4a65eedfdc98103c388d
- SHA512
  
  4a7783ffd50a669cc58b4b9d518648f8e4bfdb6399b555b231a5f0695c7d69aaad4b6ee28878e63e204d26a86818429b6d98647fa52586b87c3d18b180caf92d
- SSDEEP
  
  6144:SNW7mvIZNC7rGN3bkty0Mki8787O71rkhJSammcmZq:QW7SIa7rGNrkty0fkhAlmvq
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect XtremeRAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2