xtremerat | b1eb3a97533566f70d34bf0cbd713fe2c4561db02f348472e405b3f9da00f4e4 | Triage

Submit
Reports

Overview

overview

Static

static

7

JaffaCakes...48.exe

windows7-x64

JaffaCakes...48.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_f8fffdc36e00484ffa3fa41e04513a48
Size

223KB
Sample

250214-r3avys1jh1
MD5

f8fffdc36e00484ffa3fa41e04513a48
SHA1

be30241fc0216fdd2289956aa9566322f1ea3b91
SHA256

b1eb3a97533566f70d34bf0cbd713fe2c4561db02f348472e405b3f9da00f4e4
SHA512

a98f188f5bee25074f709b353675ebfcb38c92c80672a4bb9f5639e2f545fc8185a2ab0c76e3bfe78d56a558a88f5dfc8eb00d03675b2a1c8f2d77e0afdf313b
SSDEEP

6144:wE3SH92GIuU8FyVbfGELNdO1x6KQGrcjmt3GGYw:wEIMGvU8FyVLRdyQAt3GG/

Score

10^/10

xtremerat discovery persistence rat spyware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_f8fffdc36e00484ffa3fa41e04513a48.exe

Resource

win7-20240903-en

xtremerat discovery persistence rat spyware

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_f8fffdc36e00484ffa3fa41e04513a48.exe

Resource

win10v2004-20250211-en

xtremerat discovery persistence rat spyware

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_f8fffdc36e00484ffa3fa41e04513a48
- Size
  
  223KB
- MD5
  
  f8fffdc36e00484ffa3fa41e04513a48
- SHA1
  
  be30241fc0216fdd2289956aa9566322f1ea3b91
- SHA256
  
  b1eb3a97533566f70d34bf0cbd713fe2c4561db02f348472e405b3f9da00f4e4
- SHA512
  
  a98f188f5bee25074f709b353675ebfcb38c92c80672a4bb9f5639e2f545fc8185a2ab0c76e3bfe78d56a558a88f5dfc8eb00d03675b2a1c8f2d77e0afdf313b
- SSDEEP
  
  6144:wE3SH92GIuU8FyVbfGELNdO1x6KQGrcjmt3GGYw:wEIMGvU8FyVLRdyQAt3GG/
Score

10^/10

xtremerat discovery persistence rat spyware
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Molebox Virtualization software
  Detects file using Molebox Virtualization software.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspyware

behavioral2

xtremeratdiscoverypersistenceratspyware

© 2018-2025

Terms | Privacy