runningrat | 1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1.exe
Size

68KB
MD5

93dff428b7ecfc0e4320d5190bd095b4
SHA1

2c8b2fbc863bdbbbe9ec69ec4ca0cefa5afef503
SHA256

76d00037ad0e19a299b97f7781affae6c33254887d0068dd7d13a34cc3d26297
SHA512

a77712c3f40a0ab0ef7bfd8927f5815d1c2d506cd5013fe44a392b1f585e889001ce48e424415c4fbd0598877fd9def3a26e1d24f27731e070d34dffb1b6ba58
SSDEEP

768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMINEV:BHJaAoHoc2x7bZoYBAcQlwJdMC

Score

10^/10

runningrat

Malware Config

Signatures

RunningRat payload 1 IoCs

resource	yara_rule
sample	family_runningrat

Runningrat family
runningrat

Files

1.exe
.exe windows x86

1b365823829e2ac9bfb0aa5d328240a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler

kernel32

HeapAlloc
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
ExitProcess
CloseHandle
GetProcessHeap
GetProcAddress
LoadLibraryA
HeapReAlloc
VirtualFree
FreeLibrary
VirtualAlloc
IsBadReadPtr

Exports

Exports

dd373_dll

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ