Behavioral task
behavioral1
Sample
a7521ef22ed6639bd6ebd7c46f9728657cf5d1b51c039f3fe67b0c29efaeeedf.exe
Resource
win7-20241010-en
General
-
Target
a7521ef22ed6639bd6ebd7c46f9728657cf5d1b51c039f3fe67b0c29efaeeedf.exe
-
Size
252KB
-
MD5
7b102a452505ed401f8dd1817025deb6
-
SHA1
995555215aede21d8b2568c3a025d164d59aac0a
-
SHA256
a7521ef22ed6639bd6ebd7c46f9728657cf5d1b51c039f3fe67b0c29efaeeedf
-
SHA512
f8f7cf78fc7e63448de83065b05ff92f51fe164668211959dcf4eaa1883409a80967603d98496693b960fb99264b1bb9a9fd862aac82132ff0d9e07c5ec32b19
-
SSDEEP
1536:py4yRUHlrL1lr6an3TLuvm2hopO6MQWRvy4yRUHlrL1lr6an3TLuvm2EopO6MQWd:py4yRUZ7vkokXQAvy4yRUZ7vlokXQAX
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7521ef22ed6639bd6ebd7c46f9728657cf5d1b51c039f3fe67b0c29efaeeedf.exe
Files
-
a7521ef22ed6639bd6ebd7c46f9728657cf5d1b51c039f3fe67b0c29efaeeedf.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE