comrat | 303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731

General

Target
303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731
Size 1.6MB
Sample220124-g1s9eadedj
SHA256 303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731
MD5 f7bb82b0e665b494bcebefc7351f46c5
SHA1 0139818441431c72a1935e7f740a1cc458a63452
SHA512 1a14bbd758cb47b3939cbfdd93f4f81693e2a561d2daa6abf78c8a0eca98d65e74ddd3cc14e881b669cdc9bba8bc267e622472426a7f7c153f835ecf9947a9a8
SSDEEP 49152:ptb9JIdmNgW8Du4CuK5GN8NnpUnzezUJWJEy+yDgFP:BUDsdNnOasS/xDc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

comrat

Malware Config

Signatures

ComRAT v4 (Orchestrator DLL) 1 IoCs

File contains strings specific to ComRAT v4 samples first seen in 2017.

resource	yara_rule
sample	ComRAT

Comrat family
comrat

File Explorer

303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731

.dll 1.6MB

303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731

IMPHASH c848ddc3b4d718ac4f6fc8a5e0a15a0d
SHA256 303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731
MD5 f7bb82b0e665b494bcebefc7351f46c5
SHA1 0139818441431c72a1935e7f740a1cc458a63452
SHA512 1a14bbd758cb47b3939cbfdd93f4f81693e2a561d2daa6abf78c8a0eca98d65e74ddd3cc14e881b669cdc9bba8bc267e622472426a7f7c153f835ecf9947a9a8
SSDEEP 49152:ptb9JIdmNgW8Du4CuK5GN8NnpUnzezUJWJEy+yDgFP:BUDsdNnOasS/xDc
MD5 SHA1 SHA512 SSDEEP

windows x64

ComRAT v4 (Orchestrator DLL)

File contains strings specific to ComRAT v4 samples first seen in 2017.

Minor OS version

Major OS version

Entry point

688984

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW ExpandEnvironmentStringsW IsBadStringPtrA GetCurrentProcess OpenProcess GetLocalTime SetHandleInformation ReadFile MultiByteToWideChar CreatePipe GetProcAddress LoadLibraryA OpenEventW GetFileSize SetFilePointer WriteFile GetModuleHandleW LoadLibraryW GetVersionExW VirtualProtectEx GetExitCodeThread lstrcmpiW OutputDebugStringW VirtualFreeEx ReadProcessMemory VirtualAllocEx GetModuleHandleA WriteProcessMemory CreateThread WideCharToMultiByte CreateDirectoryW DeleteFileW CloseHandle CreateEventW TerminateProcess Sleep CreateProcessW GetLastError GetTickCount WaitForSingleObject DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetOEMCP InitializeCriticalSection SetStdHandle GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA ReadConsoleW GetSystemTimeAsFileTime GetFileAttributesExW GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapReAlloc GetCPInfo GetCommandLineA GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableW SetEnvironmentVariableA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW FreeLibrary LoadLibraryExW HeapSize GetProcessHeap GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetEnvironmentStringsW FreeEnvironmentStringsW SetEndOfFile

advapi32

CryptGenRandom RegCloseKey RegQueryValueExW RegCreateKeyExW CryptReleaseContext CryptAcquireContextW

psapi

GetModuleBaseNameA EnumProcessModulesEx EnumProcessModules

Resubmissions

Sharing