General
-
Target
rat.bin
-
Size
562KB
-
Sample
210104-hjtevjh8f6
-
MD5
f34a430619e5668615cb3ada04be4216
-
SHA1
9c1113c380db483ceb5efc712e7179cace0fefe3
-
SHA256
b584bd384f721c35557bf7acc7bb9c789d74804da8b8dbb3fd7c39586571cb1c
-
SHA512
18218a0537eec400cd414b00fcdbc21c7edd8ac39139407fac4f872fec7309da391ec69249d947d9a92e8410e3d0477c57a029a9b3ae771eaeeaa80dd445592c
Static task
static1
Behavioral task
behavioral1
Sample
rat.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
rat.bin.exe
Resource
win10v20201028
Malware Config
Extracted
remcos
cato.fingusti.club:6609
Targets
-
-
Target
rat.bin
-
Size
562KB
-
MD5
f34a430619e5668615cb3ada04be4216
-
SHA1
9c1113c380db483ceb5efc712e7179cace0fefe3
-
SHA256
b584bd384f721c35557bf7acc7bb9c789d74804da8b8dbb3fd7c39586571cb1c
-
SHA512
18218a0537eec400cd414b00fcdbc21c7edd8ac39139407fac4f872fec7309da391ec69249d947d9a92e8410e3d0477c57a029a9b3ae771eaeeaa80dd445592c
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-