xtremerat | bd4236ed5e0595110de66f110d47ee454b6a1b82f2e5b177c4e821107a33866e | Triage

Submit
Reports

Overview

overview

Static

static

3

6d4ffa294c...18.exe

windows7-x64

6d4ffa294c...18.exe

windows10-2004-x64

Sharing

General

Target

6d4ffa294c5855ef328efc08a7039634_JaffaCakes118
Size

424KB
Sample

241023-f9a9hstbkb
MD5

6d4ffa294c5855ef328efc08a7039634
SHA1

ba6888c8e0600ecb75c0240cb9e896cb99297765
SHA256

bd4236ed5e0595110de66f110d47ee454b6a1b82f2e5b177c4e821107a33866e
SHA512

b1eed03bdebc91a0b66f41f9d3a40089af76f8d5d5581a3fe028401395cb5c654bd968d97cb405729e878fca323796e95ff73b1b92983bc77771e47473031e11
SSDEEP

6144:cE9s97GiGca1hQNO8k5c5ZHey0mK0Ac8/+++++++++++++85YSd1B59kmK20FQM8:vcGd85+y7A75Y61b9ksndnL

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6d4ffa294c5855ef328efc08a7039634_JaffaCakes118.exe

Resource

win7-20241010-en

xtremerat discovery persistence rat spyware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

6d4ffa294c5855ef328efc08a7039634_JaffaCakes118.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  6d4ffa294c5855ef328efc08a7039634_JaffaCakes118
- Size
  
  424KB
- MD5
  
  6d4ffa294c5855ef328efc08a7039634
- SHA1
  
  ba6888c8e0600ecb75c0240cb9e896cb99297765
- SHA256
  
  bd4236ed5e0595110de66f110d47ee454b6a1b82f2e5b177c4e821107a33866e
- SHA512
  
  b1eed03bdebc91a0b66f41f9d3a40089af76f8d5d5581a3fe028401395cb5c654bd968d97cb405729e878fca323796e95ff73b1b92983bc77771e47473031e11
- SSDEEP
  
  6144:cE9s97GiGca1hQNO8k5c5ZHey0mK0Ac8/+++++++++++++85YSd1B59kmK20FQM8:vcGd85+y7A75Y61b9ksndnL
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

xtremeratdiscoverypersistenceratspywareupx

© 2018-2024

Terms | Privacy