xtremerat | e45ba4fdd9e74138f161a06ae437f34b45f780b6b8ad75a4cc6a0add51b754d9

General

Target
jaffacakes118_Trojan.Win32.Buzus.hrly.0ee0697f2fb708d7aeba8a86c9a89899
Size 119KB
Sample261018-3m5k6sda92
SHA256 e45ba4fdd9e74138f161a06ae437f34b45f780b6b8ad75a4cc6a0add51b754d9
MD5 0ee0697f2fb708d7aeba8a86c9a89899
SHA1 e6e6a9b0aa4eab87fbeba561d2d6338e476e2328
SHA512 cf0e5376e7e23e3f0f3596210300aa1128c49fa726fc14472078f85dedb52478066af97f88f1c604849d7d006154a81dba04e34f9635c1411b61530bca99452d
SSDEEP 1536:lHkG+d35c9xN3oLxAcuX94ZRrf1J2M2jqeRI+DTlh+6T9Zg0Sx3XLCxd:hkG+d3i9xNt+72jqeRBDT+6vg04k
TLSH
T189C3A11FB344D030E14684B92A2667B560ECA838249F641FE747EF662AF85D5F3B4703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

⾛whybifii.myftp.biz

Targets

- Target
  jaffacakes118_Trojan.Win32.Buzus.hrly.0ee0697f2fb708d7aeba8a86c9a89899
- Size 119KB
- SHA256 e45ba4fdd9e74138f161a06ae437f34b45f780b6b8ad75a4cc6a0add51b754d9
- MD5 0ee0697f2fb708d7aeba8a86c9a89899
- SHA1 e6e6a9b0aa4eab87fbeba561d2d6338e476e2328
- SHA512 cf0e5376e7e23e3f0f3596210300aa1128c49fa726fc14472078f85dedb52478066af97f88f1c604849d7d006154a81dba04e34f9635c1411b61530bca99452d
- SSDEEP 1536:lHkG+d35c9xN3oLxAcuX94ZRrf1J2M2jqeRI+DTlh+6T9Zg0Sx3XLCxd:hkG+d3i9xNt+72jqeRBDT+6vg04k
- TLSH
  T189C3A11FB344D030E14684B92A2667B560ECA838249F641FE747EF662AF85D5F3B4703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xtremerat persistence rat spyware upx
- Detect XtremeRAT payload
- Family: XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Family: XtremeRAT

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2