comrat | 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0

General

Target
3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
Size 2.0MB
Sample220415-qb13dsdde9
SHA256 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
MD5 19743d8e8590b5f644d452a9ddd77435
SHA1 28c454042b155c4356c2a78b64c25ddf020b8eba
SHA512 5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71
SSDEEP 49152:utb9JIdmNgW8Du4CuK5GN8NnpUnzezUJWJEy+yDgFP8Jz:GUDsdNnOasS/xDc8Jz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

comrat

Malware Config

Signatures

ComRAT v4 (Orchestrator DLL) 1 IoCs

File contains strings specific to ComRAT v4 samples first seen in 2017.

resource	yara_rule
sample	ComRAT

Comrat family
comrat

File Explorer

3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0

.dll 2.0MB

3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0

IMPHASH c848ddc3b4d718ac4f6fc8a5e0a15a0d
SHA256 3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0
MD5 19743d8e8590b5f644d452a9ddd77435
SHA1 28c454042b155c4356c2a78b64c25ddf020b8eba
SHA512 5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71
SSDEEP 49152:utb9JIdmNgW8Du4CuK5GN8NnpUnzezUJWJEy+yDgFP8Jz:GUDsdNnOasS/xDc8Jz
MD5 SHA1 SHA512 SSDEEP

windows x64

ComRAT v4 (Orchestrator DLL)

File contains strings specific to ComRAT v4 samples first seen in 2017.

Minor OS version

Major OS version

Entry point

688984

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW ExpandEnvironmentStringsW IsBadStringPtrA GetCurrentProcess OpenProcess GetLocalTime SetHandleInformation ReadFile MultiByteToWideChar CreatePipe GetProcAddress LoadLibraryA OpenEventW GetFileSize SetFilePointer WriteFile GetModuleHandleW LoadLibraryW GetVersionExW VirtualProtectEx GetExitCodeThread lstrcmpiW OutputDebugStringW VirtualFreeEx ReadProcessMemory VirtualAllocEx GetModuleHandleA WriteProcessMemory CreateThread WideCharToMultiByte CreateDirectoryW DeleteFileW CloseHandle CreateEventW TerminateProcess Sleep CreateProcessW GetLastError GetTickCount WaitForSingleObject DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetOEMCP InitializeCriticalSection SetStdHandle GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA ReadConsoleW GetSystemTimeAsFileTime GetFileAttributesExW GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapReAlloc GetCPInfo GetCommandLineA GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableW SetEnvironmentVariableA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW FreeLibrary LoadLibraryExW HeapSize GetProcessHeap GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetEnvironmentStringsW FreeEnvironmentStringsW SetEndOfFile

advapi32

CryptGenRandom RegCloseKey RegQueryValueExW RegCreateKeyExW CryptReleaseContext CryptAcquireContextW

psapi

GetModuleBaseNameA EnumProcessModulesEx EnumProcessModules

Name

.mulukt

Size

805KB

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

429KB

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

370KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0

kernel32

advapi32

psapi