xtremerat | 440523e49de8e740beb5610a8a7df3e7a13105299974842972d0eca0e41a18ab | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...e2.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_a1bc46093609c3c2874ec43ad13e24e2
Size

19KB
Sample

250408-1l7yssskw2
MD5

a1bc46093609c3c2874ec43ad13e24e2
SHA1

01f1b430ab08f7127d0bb16e115d7049cb0dff64
SHA256

440523e49de8e740beb5610a8a7df3e7a13105299974842972d0eca0e41a18ab
SHA512

a5f19d661f8e77f2e22bdce3f3db76288197a92db45a56b05dc77a16b9662883d743cafaeb2c8da904bf7031ef32d5f0100d78710f3a08e8aece14ef05480eb6
SSDEEP

384:jHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSfGuwgKHFzhUv7R:OZfuHUvwDKP6kMpmGuGFS

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_a1bc46093609c3c2874ec43ad13e24e2.exe

Resource

win10v2004-20250314-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_a1bc46093609c3c2874ec43ad13e24e2
- Size
  
  19KB
- MD5
  
  a1bc46093609c3c2874ec43ad13e24e2
- SHA1
  
  01f1b430ab08f7127d0bb16e115d7049cb0dff64
- SHA256
  
  440523e49de8e740beb5610a8a7df3e7a13105299974842972d0eca0e41a18ab
- SHA512
  
  a5f19d661f8e77f2e22bdce3f3db76288197a92db45a56b05dc77a16b9662883d743cafaeb2c8da904bf7031ef32d5f0100d78710f3a08e8aece14ef05480eb6
- SSDEEP
  
  384:jHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSfGuwgKHFzhUv7R:OZfuHUvwDKP6kMpmGuGFS
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

© 2018-2025

Terms | Privacy