Overview

overview

10

Static

static

3

188278452f...71.exe

windows7-x64

5

188278452f...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    188278452f81eae9bb68fdceaf6f5b75188bfb8f33792ea2115abfc12fe35871.exe

  • Size

    386KB

  • Sample

    250108-bnrxxsxnev

  • MD5

    6a01559558f60ce650be0d9ac259c5ba

  • SHA1

    80b9b13b29a147ad64793de62cd5165ed83523f0

  • SHA256

    188278452f81eae9bb68fdceaf6f5b75188bfb8f33792ea2115abfc12fe35871

  • SHA512

    5b1aaccd96c6cabaf8ad7c7ca0eef7178689af6af5c9c775dcfc22826f8bb70230133dae335f49d614b7afadf442516f2ce34108514610dde27919b1b2e0b27a

  • SSDEEP

    12288:AxFgQMRLeUfKUa0+AsFkaqLTn3YBy5aeb:IEfK/O9Tnfgeb

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      188278452f81eae9bb68fdceaf6f5b75188bfb8f33792ea2115abfc12fe35871.exe

    • Size

      386KB

    • MD5

      6a01559558f60ce650be0d9ac259c5ba

    • SHA1

      80b9b13b29a147ad64793de62cd5165ed83523f0

    • SHA256

      188278452f81eae9bb68fdceaf6f5b75188bfb8f33792ea2115abfc12fe35871

    • SHA512

      5b1aaccd96c6cabaf8ad7c7ca0eef7178689af6af5c9c775dcfc22826f8bb70230133dae335f49d614b7afadf442516f2ce34108514610dde27919b1b2e0b27a

    • SSDEEP

      12288:AxFgQMRLeUfKUa0+AsFkaqLTn3YBy5aeb:IEfK/O9Tnfgeb

    Score
    10/10
    discoveryxtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks