xtremerat | 7dcb0df9be61b214973ad738f6dbb0ab422d36f768353bf0e0039de3d404101c | Triage

Submit
Reports

Overview

overview

Static

static

5

1d312179d0...18.exe

windows7-x64

1d312179d0...18.exe

windows10-2004-x64

Sharing

General

Target

1d312179d0135358b36d666b4adfa208_JaffaCakes118
Size

47KB
Sample

241007-nkdx4swgkd
MD5

1d312179d0135358b36d666b4adfa208
SHA1

2a4ead359d6a690e58b8676cf6fb5168ef8e2dd2
SHA256

7dcb0df9be61b214973ad738f6dbb0ab422d36f768353bf0e0039de3d404101c
SHA512

1295adc07cad5d07a343fb2717a586cdeac2cd9aa09c735e18cdaf0d5612f7ac560e15bcde0d5adae734631ea6bd3a86eb3c0d2426dc688315bfac9a8b60f4ac
SSDEEP

768:OqYhhYuNYmtbhDyWmR0Mcb95nbt3BMOxS9n1as2P2s5AAbd9rpMUqXY9jcZMd:OqYhCuRyWmR01ZdR3BMeI1as2B9VMU2O

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

1d312179d0135358b36d666b4adfa208_JaffaCakes118.exe

Resource

win7-20240903-en

xtremerat discovery persistence rat spyware upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

1d312179d0135358b36d666b4adfa208_JaffaCakes118.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  1d312179d0135358b36d666b4adfa208_JaffaCakes118
- Size
  
  47KB
- MD5
  
  1d312179d0135358b36d666b4adfa208
- SHA1
  
  2a4ead359d6a690e58b8676cf6fb5168ef8e2dd2
- SHA256
  
  7dcb0df9be61b214973ad738f6dbb0ab422d36f768353bf0e0039de3d404101c
- SHA512
  
  1295adc07cad5d07a343fb2717a586cdeac2cd9aa09c735e18cdaf0d5612f7ac560e15bcde0d5adae734631ea6bd3a86eb3c0d2426dc688315bfac9a8b60f4ac
- SSDEEP
  
  768:OqYhhYuNYmtbhDyWmR0Mcb95nbt3BMOxS9n1as2P2s5AAbd9rpMUqXY9jcZMd:OqYhCuRyWmR01ZdR3BMeI1as2B9VMU2O
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

xtremeratdiscoverypersistenceratspywareupx

© 2018-2025

Terms | Privacy