xtremerat

General

Target
82138d2d48b17c580a35a31027749f26_JaffaCakes118
Size 96KB
Sample241031-hf5x5sshmn
SHA256 7552eb340f88bc4ec13824ca2080b32bde8e36c4293ce8e04fcc3b1599283fb9
MD5 82138d2d48b17c580a35a31027749f26
SHA1 548ad1d06f019070ad310d61f14b194b453e77fa
SHA512 977e2d31ac9b90116062b99d4d9baafaf79791a74869ec7608a5965d69992607957bb2214ba26ef3e3a50ec1476eab454f9dbd14ce3c8e7afbf3c24dc95bc871
SSDEEP 1536:wje6iD2YeCjWvmp5+sT4swiSBcokEpomkmSziIHM53M:93DViepvT4swiVdmQi3+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

䯬ŀ鮸끠linep.no-ip.org

Targets

- Target
  82138d2d48b17c580a35a31027749f26_JaffaCakes118
- Size 96KB
- SHA256 7552eb340f88bc4ec13824ca2080b32bde8e36c4293ce8e04fcc3b1599283fb9
- MD5 82138d2d48b17c580a35a31027749f26
- SHA1 548ad1d06f019070ad310d61f14b194b453e77fa
- SHA512 977e2d31ac9b90116062b99d4d9baafaf79791a74869ec7608a5965d69992607957bb2214ba26ef3e3a50ec1476eab454f9dbd14ce3c8e7afbf3c24dc95bc871
- SSDEEP 1536:wje6iD2YeCjWvmp5+sT4swiSBcokEpomkmSziIHM53M:93DViepvT4swiVdmQi3+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xtremerat discovery persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Xtremerat family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2