xtremerat | c70510202c462ace65b2ebd8a8f6a18bd4ce1837c8969b0cca5f4e15da91234b | Triage

Sharing

General

Target

b2c466baa06ed734c900ebb204443bab_JaffaCakes118
Size

492KB
Sample

241129-vzprgsslhl
MD5

b2c466baa06ed734c900ebb204443bab
SHA1

5e4fc6b1987be9ed5c415422323c258430aab4cb
SHA256

c70510202c462ace65b2ebd8a8f6a18bd4ce1837c8969b0cca5f4e15da91234b
SHA512

614013c91fe4e0a6d7ffb979bb1df8f6a9b5bda948ca3f272729153331f7cda57bb17181371811b9d2838c197d82dc11b65a919078d9ce0916e33637a84931ee
SSDEEP

12288:jUeogh3M90xFJGJ1F2g5IR/hv5QfUEv5vQ/NTkcGetZj7Flpp0w+7/FDryK+fv3H:jTsF2g5IR/hv5QfUEv5vQ/NTkcGetZj9

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Targets

- Target
  
  b2c466baa06ed734c900ebb204443bab_JaffaCakes118
- Size
  
  492KB
- MD5
  
  b2c466baa06ed734c900ebb204443bab
- SHA1
  
  5e4fc6b1987be9ed5c415422323c258430aab4cb
- SHA256
  
  c70510202c462ace65b2ebd8a8f6a18bd4ce1837c8969b0cca5f4e15da91234b
- SHA512
  
  614013c91fe4e0a6d7ffb979bb1df8f6a9b5bda948ca3f272729153331f7cda57bb17181371811b9d2838c197d82dc11b65a919078d9ce0916e33637a84931ee
- SSDEEP
  
  12288:jUeogh3M90xFJGJ1F2g5IR/hv5QfUEv5vQ/NTkcGetZj7Flpp0w+7/FDryK+fv3H:jTsF2g5IR/hv5QfUEv5vQ/NTkcGetZj9
Score

10^/10

xtremerat discovery persistence rat spyware
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspyware

behavioral2