Overview

overview

10

Static

static

10

56f997e962...ff.exe

windows7_x64

10

56f997e962...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

  • Size

    143KB

  • Sample

    220524-3l5vjsbgf5

  • MD5

    8f38ff3ef82c67973cde234bc4dcc81f

  • SHA1

    61c260224bc8c42feacb0bd93aeec57cc4990ebe

  • SHA256

    56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

  • SHA512

    a4a0223739eba5473ef48603ca4edc5822b364e18632bb2d9a00095bde735699d2f3cdf2cb6d03c1a4034c31fa56d6b6107f610daa03f1840bb07303d10cfc99

Score
10/10
vanillaratpersistencerat

Malware Config

Targets

    • Target

      56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

    • Size

      143KB

    • MD5

      8f38ff3ef82c67973cde234bc4dcc81f

    • SHA1

      61c260224bc8c42feacb0bd93aeec57cc4990ebe

    • SHA256

      56f997e962a98db0173429f115f2b522ae06ea134265395d7a1b47461cdbb4ff

    • SHA512

      a4a0223739eba5473ef48603ca4edc5822b364e18632bb2d9a00095bde735699d2f3cdf2cb6d03c1a4034c31fa56d6b6107f610daa03f1840bb07303d10cfc99

    Score
    10/10
    vanillaratpersistencerat

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

      ratvanillarat

    • Vanilla Rat Payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks