xtremerat | 1d28a6389bb2de22013f3db9fdd144fc606347fe165a550ca22429570deb4280

General

Target
jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec
Size 1.2MB
Sample260920-2lnqlatzav
SHA256 1d28a6389bb2de22013f3db9fdd144fc606347fe165a550ca22429570deb4280
MD5 2911a2d0849999cd6aa4bb2d90fe45ec
SHA1 7d20b672c88fca3c2a53fef6848dddc068fba0e2
SHA512 f35c995d6e05408e488066a1606b9bc814b6cd5cec460b83ae7f7d0b71f102ad905db7ec44dc759ce690c438f4a0e65c025f3a312399e9bf7e5778a4478d824a
SSDEEP 12288:8btIEYQqLW7y3l+LUZclgdYxThUegN56fIM6SkYQqLWpbtIEUZclgdYxThUegN5i:8nYJLT3lokYJLYBREk8n4XYJL
TLSH
T1584583253A78522BD060D6B8CFE1B463A41BBC2F35D08C7191A6770A83B7F47259B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

z2a.no-ip.info

Targets

- Target
  jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec
- Size 1.2MB
- SHA256 1d28a6389bb2de22013f3db9fdd144fc606347fe165a550ca22429570deb4280
- MD5 2911a2d0849999cd6aa4bb2d90fe45ec
- SHA1 7d20b672c88fca3c2a53fef6848dddc068fba0e2
- SHA512 f35c995d6e05408e488066a1606b9bc814b6cd5cec460b83ae7f7d0b71f102ad905db7ec44dc759ce690c438f4a0e65c025f3a312399e9bf7e5778a4478d824a
- SSDEEP 12288:8btIEYQqLW7y3l+LUZclgdYxThUegN56fIM6SkYQqLWpbtIEUZclgdYxThUegN5i:8nYJLT3lokYJLYBREk8n4XYJL
- TLSH
  T1584583253A78522BD060D6B8CFE1B463A41BBC2F35D08C7191A6770A83B7F47259B63D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xtremerat persistence rat spyware
- Detect XtremeRAT payload
- Family: XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Family: XtremeRAT

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2