xtremerat | 73686e12bb2418752e07871231b64c34fbe996f810d05a642b066218b385d30a | Triage

Submit
Reports

Overview

overview

Static

static

3

72535075f9...18.exe

windows7-x64

72535075f9...18.exe

windows10-2004-x64

Sharing

General

Target

72535075f9d9badf16356d9685a0694b_JaffaCakes118
Size

365KB
Sample

241024-e4q74swcnq
MD5

72535075f9d9badf16356d9685a0694b
SHA1

33f0915520b53d0ac678392e04eff3142578ec09
SHA256

73686e12bb2418752e07871231b64c34fbe996f810d05a642b066218b385d30a
SHA512

84d87272e08aa4caf13fbe988d0d7d33a095fbb3750cdf2a0cbd647c08bc64378a6875e4aa7bb87fc8658f1f929bdc4a356e3a3f147766dc31fc69824ffe8648
SSDEEP

6144:SwRqy7KFKYkUikWzfcIWubtI7IWsf8bQvC5JjBzxcJsq53TEE2xdt3hLXIh/G3Sv:SwR37KMYk1tWubtI7I/8bQapFcJsu3o0

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

72535075f9d9badf16356d9685a0694b_JaffaCakes118.exe

Resource

win7-20241010-en

xtremerat discovery persistence rat spyware upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

72535075f9d9badf16356d9685a0694b_JaffaCakes118.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  72535075f9d9badf16356d9685a0694b_JaffaCakes118
- Size
  
  365KB
- MD5
  
  72535075f9d9badf16356d9685a0694b
- SHA1
  
  33f0915520b53d0ac678392e04eff3142578ec09
- SHA256
  
  73686e12bb2418752e07871231b64c34fbe996f810d05a642b066218b385d30a
- SHA512
  
  84d87272e08aa4caf13fbe988d0d7d33a095fbb3750cdf2a0cbd647c08bc64378a6875e4aa7bb87fc8658f1f929bdc4a356e3a3f147766dc31fc69824ffe8648
- SSDEEP
  
  6144:SwRqy7KFKYkUikWzfcIWubtI7IWsf8bQvC5JjBzxcJsq53TEE2xdt3hLXIh/G3Sv:SwR37KMYk1tWubtI7I/8bQapFcJsu3o0
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

xtremeratdiscoverypersistenceratspywareupx

© 2018-2025

Terms | Privacy