xtremerat | 2eebb01735dc5f1678c9f4a0ac9f16b1ce458a3664cb55121ac6999ab365446f | Triage

Submit
Reports

Overview

overview

Static

static

3

b62b5bd3e4...18.exe

windows7-x64

b62b5bd3e4...18.exe

windows10-2004-x64

Sharing

General

Target

b62b5bd3e4c242f1bb9c43bf847b3f53_JaffaCakes118
Size

176KB
Sample

241202-b4lqvasqay
MD5

b62b5bd3e4c242f1bb9c43bf847b3f53
SHA1

479ffc975d8cd98d393379de3e216b8426e61e62
SHA256

2eebb01735dc5f1678c9f4a0ac9f16b1ce458a3664cb55121ac6999ab365446f
SHA512

f7968db1abc649d4d54a1183fdc70a96015536d7ed022eb8d323d3b35b26b8052b453ded76e40f385f4a7631629dcf337b861a681eacca46ae333057e635fe1f
SSDEEP

3072:ENn2WMWIraMXXLS8RdRzn18jWHBoCyNlxdSFUCEZl/X1pbclN6PQm1niRO5Wv:EslW6H+8RdRzn2jWHnyNnA81iQ58

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b62b5bd3e4c242f1bb9c43bf847b3f53_JaffaCakes118.exe

Resource

win7-20240903-en

xtremerat discovery persistence rat spyware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

b62b5bd3e4c242f1bb9c43bf847b3f53_JaffaCakes118.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  b62b5bd3e4c242f1bb9c43bf847b3f53_JaffaCakes118
- Size
  
  176KB
- MD5
  
  b62b5bd3e4c242f1bb9c43bf847b3f53
- SHA1
  
  479ffc975d8cd98d393379de3e216b8426e61e62
- SHA256
  
  2eebb01735dc5f1678c9f4a0ac9f16b1ce458a3664cb55121ac6999ab365446f
- SHA512
  
  f7968db1abc649d4d54a1183fdc70a96015536d7ed022eb8d323d3b35b26b8052b453ded76e40f385f4a7631629dcf337b861a681eacca46ae333057e635fe1f
- SSDEEP
  
  3072:ENn2WMWIraMXXLS8RdRzn18jWHBoCyNlxdSFUCEZl/X1pbclN6PQm1niRO5Wv:EslW6H+8RdRzn2jWHnyNnA81iQ58
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

behavioral2

xtremeratdiscoverypersistenceratspywareupx

© 2018-2024

Terms | Privacy