General
-
Target
6bcbaa38da5cc1777a9808059f5ed00c2945260ad490a80b8b6fc5a347551f7fN.exe
-
Size
52KB
-
Sample
241208-ev82kasles
-
MD5
c65ecfd4c3845d1c4e3a606d0c2ca460
-
SHA1
0e1a1e0056164441963e85a86013c9aa16cbfa7e
-
SHA256
6bcbaa38da5cc1777a9808059f5ed00c2945260ad490a80b8b6fc5a347551f7f
-
SHA512
010fe788faa96a9e0d6dae2de50643e90b3db3da016c75f6acb8dd079c6a57fc99642a14a6873a9ce4eba1005ad59c24232725cab963e9ffa226288109627a10
-
SSDEEP
768:GB6cZMRRWKFv0MYTgHn5XKj8Y2DiT+zIXX+bzIO5JFSwNMr6svDEdx3yo:GYWixYTYn/Di+rFS0svDEt
Malware Config
Targets
-
-
Target
6bcbaa38da5cc1777a9808059f5ed00c2945260ad490a80b8b6fc5a347551f7fN.exe
-
Size
52KB
-
MD5
c65ecfd4c3845d1c4e3a606d0c2ca460
-
SHA1
0e1a1e0056164441963e85a86013c9aa16cbfa7e
-
SHA256
6bcbaa38da5cc1777a9808059f5ed00c2945260ad490a80b8b6fc5a347551f7f
-
SHA512
010fe788faa96a9e0d6dae2de50643e90b3db3da016c75f6acb8dd079c6a57fc99642a14a6873a9ce4eba1005ad59c24232725cab963e9ffa226288109627a10
-
SSDEEP
768:GB6cZMRRWKFv0MYTgHn5XKj8Y2DiT+zIXX+bzIO5JFSwNMr6svDEdx3yo:GYWixYTYn/Di+rFS0svDEt
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1