General
-
Target
666e92c480aac82c9a08da1d38912788a0275bb8d855af113381e078871c512bN
-
Size
156KB
-
Sample
241011-c653ya1fmb
-
MD5
f580dd5ce8a635f9d74953a05a91a100
-
SHA1
06dad2dfedbab9cb8fe22b8b4f8355ec07b4072a
-
SHA256
666e92c480aac82c9a08da1d38912788a0275bb8d855af113381e078871c512b
-
SHA512
aedfa2f4a68754ed352ed846d62097214fedfb046869733c8964a621d2ece03707b617fadf934e3fdf57c50a4d8f27a11b5a28639d5e87a73b6c7868e82c826e
-
SSDEEP
1536:IgIsFoyRUHlrL1lr6an3TLuvm2waofwt6MQVXNbd:IgtFoyRUZ7v0oaXQJNB
Behavioral task
behavioral1
Sample
666e92c480aac82c9a08da1d38912788a0275bb8d855af113381e078871c512bN.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
666e92c480aac82c9a08da1d38912788a0275bb8d855af113381e078871c512bN
-
Size
156KB
-
MD5
f580dd5ce8a635f9d74953a05a91a100
-
SHA1
06dad2dfedbab9cb8fe22b8b4f8355ec07b4072a
-
SHA256
666e92c480aac82c9a08da1d38912788a0275bb8d855af113381e078871c512b
-
SHA512
aedfa2f4a68754ed352ed846d62097214fedfb046869733c8964a621d2ece03707b617fadf934e3fdf57c50a4d8f27a11b5a28639d5e87a73b6c7868e82c826e
-
SSDEEP
1536:IgIsFoyRUHlrL1lr6an3TLuvm2waofwt6MQVXNbd:IgtFoyRUZ7v0oaXQJNB
-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1