xtremerat

General

Target

JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07
Size

73KB
Sample

250129-qpxxwsxlem
MD5

575b96ec9b4804a85c93c1efbdaf3a07
SHA1

5b660efedac9fb706486b124b44772d5f4cf7c55
SHA256

8fc739fba82f000c0bb27db6abb8219bb5f29f36dc0d176d740beb178fca5dea
SHA512

d3c4218796edded5fc6ba1559af79b3c886a1cf09e76d3a7e5e9fa1ae2f80a71475f06c6e1a163fa769b33595350b4d2740ea3313368e4bdf21a49c4cd497b5d
SSDEEP

1536:bTxHaFqdW7weEwzJWSLwIZVcOzB2AziNNLS6M6Tzm:HxHaFqdW7weEwzJBZVcYB2uuS6MKm

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_575b96ec9b4804a85c93c1efbdaf3a07
- Size
  
  73KB
- MD5
  
  575b96ec9b4804a85c93c1efbdaf3a07
- SHA1
  
  5b660efedac9fb706486b124b44772d5f4cf7c55
- SHA256
  
  8fc739fba82f000c0bb27db6abb8219bb5f29f36dc0d176d740beb178fca5dea
- SHA512
  
  d3c4218796edded5fc6ba1559af79b3c886a1cf09e76d3a7e5e9fa1ae2f80a71475f06c6e1a163fa769b33595350b4d2740ea3313368e4bdf21a49c4cd497b5d
- SSDEEP
  
  1536:bTxHaFqdW7weEwzJWSLwIZVcOzB2AziNNLS6M6Tzm:HxHaFqdW7weEwzJBZVcYB2uuS6MKm
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect XtremeRAT payload

Xtremerat family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2