xtremerat | e16a646b42cd98b118fce2036cd0e79cc245164ff7d942a53216ffc11d3548b0 | Triage

Submit
Reports

Overview

overview

Static

static

3

3a8e4ade3d...18.exe

windows7-x64

3a8e4ade3d...18.exe

windows10-2004-x64

3

Sharing

General

Target

3a8e4ade3dd3a8438f42ed6435ad0219_JaffaCakes118
Size

75KB
Sample

241012-r1d5lavhlh
MD5

3a8e4ade3dd3a8438f42ed6435ad0219
SHA1

f4e83178bde879e258f97b3e374569e14ff41809
SHA256

e16a646b42cd98b118fce2036cd0e79cc245164ff7d942a53216ffc11d3548b0
SHA512

28b36407a4df66da558fedd0f959dd2582e02f6598a6130dd0c915003fe5a606993f8228c7654bb176452a290882fe09bf646f83869a7c69b4a95e50d7123ecf
SSDEEP

1536:QWXPsQAKQ09aMI0Wvu7bemDBbezJ0/NbFc2pY/TgltTgIXLnMvvf:QWXXAKQ09a076l0/I0Ybglt7ef

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3a8e4ade3dd3a8438f42ed6435ad0219_JaffaCakes118.exe

Resource

win7-20240903-en

xtremerat discovery persistence rat spyware upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

3a8e4ade3dd3a8438f42ed6435ad0219_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  3a8e4ade3dd3a8438f42ed6435ad0219_JaffaCakes118
- Size
  
  75KB
- MD5
  
  3a8e4ade3dd3a8438f42ed6435ad0219
- SHA1
  
  f4e83178bde879e258f97b3e374569e14ff41809
- SHA256
  
  e16a646b42cd98b118fce2036cd0e79cc245164ff7d942a53216ffc11d3548b0
- SHA512
  
  28b36407a4df66da558fedd0f959dd2582e02f6598a6130dd0c915003fe5a606993f8228c7654bb176452a290882fe09bf646f83869a7c69b4a95e50d7123ecf
- SSDEEP
  
  1536:QWXPsQAKQ09aMI0Wvu7bemDBbezJ0/NbFc2pY/TgltTgIXLnMvvf:QWXXAKQ09a076l0/I0Ybglt7ef
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

© 2018-2024

Terms | Privacy