vanillarat | download[.]exe

General

Target
download.exe
Size 114KB
Sample230709-sarhnsdd96
SHA256 6957a1d41318c04e7086774c6822dff2684a62300ece32225e1080cd0acc8a49
MD5 3d31c31ef4a60bf94a3d70abc8c6dfe3
SHA1 03912837c3f31bcd0c6f0c2aaa68cd3535d8cc99
SHA512 5ba7dd53e3b4af4442b8f33d8882b19698fb6c9262b5bc2fcbc6841b8ce9cc85c9e7eea8a317358aba9849fd33d86c82abf39bc6d44f8b9b98a7cd93b5baeed1
SSDEEP 3072:AJZKnPE2YyJzELtyTRyYeY8lNgoiJ+sX8HFvytbwN4:AJZKBI0RyYeY4eoiJ+sCFvj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat vanillarat

Malware Config

Signatures

Vanilla Rat payload 1 IoCs

rat

resource	yara_rule
sample	vanillarat

Vanillarat family
vanillarat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
download.exe

File Explorer

download.exe

.exe 114KB

download.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6957a1d41318c04e7086774c6822dff2684a62300ece32225e1080cd0acc8a49
MD5 3d31c31ef4a60bf94a3d70abc8c6dfe3
SHA1 03912837c3f31bcd0c6f0c2aaa68cd3535d8cc99
SHA512 5ba7dd53e3b4af4442b8f33d8882b19698fb6c9262b5bc2fcbc6841b8ce9cc85c9e7eea8a317358aba9849fd33d86c82abf39bc6d44f8b9b98a7cd93b5baeed1
SSDEEP 3072:AJZKnPE2YyJzELtyTRyYeY8lNgoiJ+sX8HFvytbwN4:AJZKBI0RyYeY4eoiJ+sCFvj
MD5 SHA1 SHA512 SSDEEP

windows x86

Vanilla Rat payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

122414

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

download.exe

mscoree