Behavioral task
behavioral1
Sample
c3fa10d62886c6fd69c528214326f5374b0a2a9261efc86b0c631c6a6785d493N.exe
Resource
win7-20240903-en
General
-
Target
c3fa10d62886c6fd69c528214326f5374b0a2a9261efc86b0c631c6a6785d493N
-
Size
1.2MB
-
MD5
0886c7845c2c636c6a6f01ec578d1e50
-
SHA1
d47257d0cb204deb5c29779eccefbbc88031fdc0
-
SHA256
c3fa10d62886c6fd69c528214326f5374b0a2a9261efc86b0c631c6a6785d493
-
SHA512
e386cdbc39b9da87448f9cd2b3ee3384b9d3034a91146252568778baae7307613bae59be1e52eb12006a98d621e717757779b1d36f2a038e714019498cc54be4
-
SSDEEP
12288:h5uEjhAZlNqhWgGe7XTp+iUI5uA5uEjhAZlNqhWgGe7XTp+iUI5u:1j+ZlNqEgjTptJj+ZlNqEgjTpt
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3fa10d62886c6fd69c528214326f5374b0a2a9261efc86b0c631c6a6785d493N
Files
-
c3fa10d62886c6fd69c528214326f5374b0a2a9261efc86b0c631c6a6785d493N.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 628KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE