xtremerat

General

Target

233d641f496d2fad3c1897548adc2865_JaffaCakes118
Size

65KB
Sample

241008-wsjsbstdrf
MD5

233d641f496d2fad3c1897548adc2865
SHA1

8148e7dee1f27a0153810566b0c8b6a5fd5bb80d
SHA256

be1f404da2653f9bc628ef22aaf4515458a34ba644795ef9e2cc3e443f876d5d
SHA512

d823ec28cc799b958c4edac2f8d8a6c18f7472ca804b21800687c2af6da817364606abd48fd46886eaa93d6f884b35ffba6ae14a7fa63e8e73a11adfea73ce6a
SSDEEP

768:S9m1Sq4NQNLBQH1vcz0wDeeQuMVTyN8ihHo3VVmh6A9XVtWA1LA+7coNw8S9PNv:fsq+Qq6ZQuIyJhemUARF1EyNwV

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

123vivalgerie.no-ip.biz

ƶallgeriaa.zapto.org

getdesktoppreviewinfo|130mahdidi.zapto.org

ƶ123vivalgerie.no-ip.biz

Targets

- Target
  
  233d641f496d2fad3c1897548adc2865_JaffaCakes118
- Size
  
  65KB
- MD5
  
  233d641f496d2fad3c1897548adc2865
- SHA1
  
  8148e7dee1f27a0153810566b0c8b6a5fd5bb80d
- SHA256
  
  be1f404da2653f9bc628ef22aaf4515458a34ba644795ef9e2cc3e443f876d5d
- SHA512
  
  d823ec28cc799b958c4edac2f8d8a6c18f7472ca804b21800687c2af6da817364606abd48fd46886eaa93d6f884b35ffba6ae14a7fa63e8e73a11adfea73ce6a
- SSDEEP
  
  768:S9m1Sq4NQNLBQH1vcz0wDeeQuMVTyN8ihHo3VVmh6A9XVtWA1LA+7coNw8S9PNv:fsq+Qq6ZQuIyJhemUARF1EyNwV
Score

10^/10

xtremerat discovery persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2