xtremerat | 06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682 | Triage

Submit
Reports

Overview

overview

Static

static

06d3098605...82.exe

windows10-2004-x64

Sharing

General

Target

06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682
Size

226KB
Sample

250412-yx6h1az1dt
MD5

a8f27f786cd4cf5e1dfb3817478f23b6
SHA1

97c0c92f9f394332386b93c2d93d0e7c5adef0af
SHA256

06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682
SHA512

1f07d6266b1ac8dcf7fbdb1b2498225c460d5b29f622f1cf5be42b262dffa8e773ebc15f78e2b18037a87c7850a80e8dddf44ebff9527c1c4ad0526f2365effb
SSDEEP

3072:jZkRi4rd9GTXuI7E9n6nUaiUdLA34OS7lRT2k7jGliNuOegNKeTy3hFijXMlJE:jWRTjySnqUai1o7+0Gl21VTymjXMlJE

Score

10^/10

xtremerat discovery persistence rat spyware upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682.exe

Resource

win10v2004-20250314-en

xtremerat discovery persistence rat spyware upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682
- Size
  
  226KB
- MD5
  
  a8f27f786cd4cf5e1dfb3817478f23b6
- SHA1
  
  97c0c92f9f394332386b93c2d93d0e7c5adef0af
- SHA256
  
  06d309860576546e54315dc5d8d36410ae0355fef600d7af1b2f6aeb8f198682
- SHA512
  
  1f07d6266b1ac8dcf7fbdb1b2498225c460d5b29f622f1cf5be42b262dffa8e773ebc15f78e2b18037a87c7850a80e8dddf44ebff9527c1c4ad0526f2365effb
- SSDEEP
  
  3072:jZkRi4rd9GTXuI7E9n6nUaiUdLA34OS7lRT2k7jGliNuOegNKeTy3hFijXMlJE:jWRTjySnqUai1o7+0Gl21VTymjXMlJE
Score

10^/10

xtremerat discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xtremeratdiscoverypersistenceratspywareupx

© 2018-2025

Terms | Privacy