Behavioral task
behavioral1
Sample
018b422d4cfaf8fa252fc7db930d366d24b838adfad7bc812c07bb547da60090N.exe
Resource
win7-20250207-en
General
-
Target
018b422d4cfaf8fa252fc7db930d366d24b838adfad7bc812c07bb547da60090N.exe
-
Size
252KB
-
MD5
a27af7113ae1e1b1fc9196ae99a63d50
-
SHA1
0e74d7b8ba99678d9f1991958a5d8f3c7c730041
-
SHA256
018b422d4cfaf8fa252fc7db930d366d24b838adfad7bc812c07bb547da60090
-
SHA512
006749f00fbd4b2d0d06c8d305787020fba97e0c8c8ba6516138134f888eed4b44eb45f37f730490cedd31defdd6c41f31a1405048571d8d9218c9f151d9818c
-
SSDEEP
1536:py4yRUHlrL1lr6an3TLuvm2hopO6MQWRvy4yRUHlrL1lr6an3TLuvm2EopO6MQWR:py4yRUZ7vkokXQAvy4yRUZ7vlokXQA
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 018b422d4cfaf8fa252fc7db930d366d24b838adfad7bc812c07bb547da60090N.exe
Files
-
018b422d4cfaf8fa252fc7db930d366d24b838adfad7bc812c07bb547da60090N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE