Overview

overview

10

Static

static

10

56f997e962...ff.exe

windows7_x64

10

56f997e962...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

  • Size

    143KB

  • Sample

    220524-3l5vjsbgf5

  • MD5

    8f38ff3ef82c67973cde234bc4dcc81f

  • SHA1

    61c260224bc8c42feacb0bd93aeec57cc4990ebe

  • SHA256

    56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

  • SHA512

    a4a0223739eba5473ef48603ca4edc5822b364e18632bb2d9a00095bde735699d2f3cdf2cb6d03c1a4034c31fa56d6b6107f610daa03f1840bb07303d10cfc99

Score
10/10
vanillaratpersistencerat

Malware Config

Targets

    • Target

      56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

    • Size

      143KB

    • MD5

      8f38ff3ef82c67973cde234bc4dcc81f

    • SHA1

      61c260224bc8c42feacb0bd93aeec57cc4990ebe

    • SHA256

      56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

    • SHA512

      a4a0223739eba5473ef48603ca4edc5822b364e18632bb2d9a00095bde735699d2f3cdf2cb6d03c1a4034c31fa56d6b6107f610daa03f1840bb07303d10cfc99

    Score
    10/10
    vanillaratpersistencerat

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

      ratvanillarat

    • Vanilla Rat Payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks