xtremerat | 6c5e5bf4128285e6da84852003dc125bbf36a67d42dfaf55ccd3658de4b87c4b | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...cf.exe

windows7-x64

JaffaCakes...cf.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_2ada9bc30cae2fcaf9f8a816265616cf
Size

278KB
Sample

250125-mvkyqs1kgq
MD5

2ada9bc30cae2fcaf9f8a816265616cf
SHA1

34e62bff42242a7863c444786fa1774ab8f58bbf
SHA256

6c5e5bf4128285e6da84852003dc125bbf36a67d42dfaf55ccd3658de4b87c4b
SHA512

15e20fed31de6171e4f0f64ab2b90fbf598d0d6a4348c427fa0ddb3723f8f1c71c3a6985fae0ffe492e767872c607ae07b643e04e2d36c0d1b9a33c7edc33741
SSDEEP

1536:c+inrUPpUKv9w/MHweNh1ZqL3JemIxVzBP:3in4pUKvXLN2JVMh

Score

10^/10

xtremerat discovery persistence rat spyware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_2ada9bc30cae2fcaf9f8a816265616cf.exe

Resource

win7-20240903-en

xtremerat discovery persistence rat spyware

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_2ada9bc30cae2fcaf9f8a816265616cf.exe

Resource

win10v2004-20241007-en

xtremerat discovery persistence rat spyware

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_2ada9bc30cae2fcaf9f8a816265616cf
- Size
  
  278KB
- MD5
  
  2ada9bc30cae2fcaf9f8a816265616cf
- SHA1
  
  34e62bff42242a7863c444786fa1774ab8f58bbf
- SHA256
  
  6c5e5bf4128285e6da84852003dc125bbf36a67d42dfaf55ccd3658de4b87c4b
- SHA512
  
  15e20fed31de6171e4f0f64ab2b90fbf598d0d6a4348c427fa0ddb3723f8f1c71c3a6985fae0ffe492e767872c607ae07b643e04e2d36c0d1b9a33c7edc33741
- SSDEEP
  
  1536:c+inrUPpUKv9w/MHweNh1ZqL3JemIxVzBP:3in4pUKvXLN2JVMh
Score

10^/10

xtremerat discovery persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspyware

behavioral2

xtremeratdiscoverypersistenceratspyware

© 2018-2025

Terms | Privacy