xtremerat | f550c579402acc3120b8e7d44e76058c26f8304561a25949d5197d245e72e41f | Triage

Submit
Reports

Overview

overview

Static

static

5

31ab9fed0b...18.exe

windows7-x64

31ab9fed0b...18.exe

windows10-2004-x64

Sharing

General

Target

31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118
Size

1.2MB
Sample

241010-y4k6mszgnp
MD5

31ab9fed0b7551a2e91f95d8f7d4b925
SHA1

a7def0e837394cd9fddc20d40569bb3fba5c2cfb
SHA256

f550c579402acc3120b8e7d44e76058c26f8304561a25949d5197d245e72e41f
SHA512

4e8e838e0924c85f2d827bee28206e323ff637e194e6d982714e24adda1e28fdc2fd123cac5f02dcc143fba088410dda26d7ecf91a7e35f415d0fc1f3cd11404
SSDEEP

24576:XthEVaPqLSxpqb7fAFHp/zkqokrne4E2Bfg/n0b24CYDtVgaVkQY6:bEVUc0pqoLkune4E2Bga24CYDDJSY

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118.exe

Resource

win7-20241010-en

xtremerat discovery persistence rat spyware upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  31ab9fed0b7551a2e91f95d8f7d4b925
- SHA1
  
  a7def0e837394cd9fddc20d40569bb3fba5c2cfb
- SHA256
  
  f550c579402acc3120b8e7d44e76058c26f8304561a25949d5197d245e72e41f
- SHA512
  
  4e8e838e0924c85f2d827bee28206e323ff637e194e6d982714e24adda1e28fdc2fd123cac5f02dcc143fba088410dda26d7ecf91a7e35f415d0fc1f3cd11404
- SSDEEP
  
  24576:XthEVaPqLSxpqb7fAFHp/zkqokrne4E2Bfg/n0b24CYDtVgaVkQY6:bEVUc0pqoLkune4E2Bga24CYDDJSY
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

xtremeratdiscoverypersistenceratspywareupx

© 2018-2025

Terms | Privacy