xtremerat | 54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48 | Triage

Submit
Reports

Overview

overview

Static

static

3

54072487e3...8N.exe

windows7-x64

54072487e3...8N.exe

windows10-2004-x64

Sharing

General

Target

54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48N
Size

160KB
Sample

241021-ythb1avhjn
MD5

5e0eee66ca4878538b0cb90f6106e880
SHA1

1aa7757a863b4c7392eb2bb2691c88884e389ad8
SHA256

54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48
SHA512

d2b573aaf1cf870af1fb7c0eb6abe2575eca8647226567dbbe172f57408b27003fbf295c59189ca2dc38eade9f80bacfc9972ec1f06d515c416a176461a24708
SSDEEP

3072:XvhFBDi9gGx+hXbGF3Gb0aRQFhpghWQe/Gf287GeApi/8mjrE3G://Mhx+hOGbnRQqwt/GHGewiEmjrGG

Score

10^/10

xtremerat discovery persistence rat spyware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48N.exe

Resource

win7-20240729-en

xtremerat discovery persistence rat spyware

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48N.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Targets

- Target
  
  54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48N
- Size
  
  160KB
- MD5
  
  5e0eee66ca4878538b0cb90f6106e880
- SHA1
  
  1aa7757a863b4c7392eb2bb2691c88884e389ad8
- SHA256
  
  54072487e398c918ee2f2962c2195f4e0712654d954035e6df3390b8cd18ec48
- SHA512
  
  d2b573aaf1cf870af1fb7c0eb6abe2575eca8647226567dbbe172f57408b27003fbf295c59189ca2dc38eade9f80bacfc9972ec1f06d515c416a176461a24708
- SSDEEP
  
  3072:XvhFBDi9gGx+hXbGF3Gb0aRQFhpghWQe/Gf287GeApi/8mjrE3G://Mhx+hOGbnRQqwt/GHGewiEmjrGG
Score

10^/10

xtremerat discovery persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspyware

behavioral2

xtremeratdiscoverypersistenceratspyware

© 2018-2024

Terms | Privacy