Behavioral task
behavioral1
Sample
c64692d038f1cc601fa41b9592a7d8159fe35c3cc209ed98e2948dd97c2b035f.exe
Resource
win7-20240708-en
General
-
Target
c64692d038f1cc601fa41b9592a7d8159fe35c3cc209ed98e2948dd97c2b035f
-
Size
692KB
-
MD5
b1ccd2bee2616c81f4d1799ac0dbb0f5
-
SHA1
42d7e9b6438902ed94f9e0f1d688503213ad3c2d
-
SHA256
c64692d038f1cc601fa41b9592a7d8159fe35c3cc209ed98e2948dd97c2b035f
-
SHA512
ac37b74a8c4eb02a308b0fd48355724c1b500e7d4990a143089e05c8081b9d7a020647c10ee81dbf2ec99e68b988daca83c6c3b2924a6392f91453151bf03548
-
SSDEEP
1536:0sqTsq+QV4rObAdNoAf5UqyYedo1WB9tTbsqTsq+QV4rObAdNoAf5UqyYeu8o1Wp:Z44rOBjo1WBbTG44rOBlo1WBbT
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c64692d038f1cc601fa41b9592a7d8159fe35c3cc209ed98e2948dd97c2b035f
Files
-
c64692d038f1cc601fa41b9592a7d8159fe35c3cc209ed98e2948dd97c2b035f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 384KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE