xtremerat | 1dfb23fcc2ed0e031eb6e72ee79d76ef96616b3337c6bf7abac85423c2ef30e1

General

Target
jaffacakes118_Trojan.Win32.Llac.kzwq.285c2fcabb772bc3afdbdfaf5ceb6108
Size 468KB
Sample261018-smrzzaet2q
SHA256 1dfb23fcc2ed0e031eb6e72ee79d76ef96616b3337c6bf7abac85423c2ef30e1
MD5 285c2fcabb772bc3afdbdfaf5ceb6108
SHA1 34f38fed13ba3e7f95150bf8569ad621c36e09ea
SHA512 b4a7dbea4206c44ff3602ea74daf75714ea6be3015a96f7b60764d64427abf1b034cdb147c2eb9be09451fe0e81840f78d4b20b93b4e80c0b1251090bf697916
SSDEEP 12288:FujB8jeLvUwZnWwYys49h+TmvzZfvHP/ZRKwmmOjHs5N:FujamUr2HtZHXjOjM/
TLSH
T161A4238A8BA40F79E429517AA733C3B4A49BA115DB6DEF4F01E3F04307911B0D66B85E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

裌zapata36.zapto.org

Targets

- Target
  jaffacakes118_Trojan.Win32.Llac.kzwq.285c2fcabb772bc3afdbdfaf5ceb6108
- Size 468KB
- SHA256 1dfb23fcc2ed0e031eb6e72ee79d76ef96616b3337c6bf7abac85423c2ef30e1
- MD5 285c2fcabb772bc3afdbdfaf5ceb6108
- SHA1 34f38fed13ba3e7f95150bf8569ad621c36e09ea
- SHA512 b4a7dbea4206c44ff3602ea74daf75714ea6be3015a96f7b60764d64427abf1b034cdb147c2eb9be09451fe0e81840f78d4b20b93b4e80c0b1251090bf697916
- SSDEEP 12288:FujB8jeLvUwZnWwYys49h+TmvzZfvHP/ZRKwmmOjHs5N:FujamUr2HtZHXjOjM/
- TLSH
  T161A4238A8BA40F79E429517AA733C3B4A49BA115DB6DEF4F01E3F04307911B0D66B85E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xtremerat persistence rat spyware upx
- Detect XtremeRAT payload
- Family: XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

Family: XtremeRAT

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2