Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2023 12:33
Behavioral task
behavioral1
Sample
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe
Resource
win10v2004-20230703-en
General
-
Target
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe
-
Size
115KB
-
MD5
b76d1f217230723ebce9e7da6c141900
-
SHA1
988302be6face5989f5ddf9ea89594d38ba5a9d5
-
SHA256
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466
-
SHA512
1ba509c37615c2038f455a08bab976c88ff2670793e8bab1602c156f3a6ad7c83fe1ea6e24a02a6f7854c33f8bfc0dbd6ff7da62214a4ecee4ccdb0d83e27927
-
SSDEEP
3072:tJZKnPE2YyJzELtyTFyYeY8lNgoiJ+sX8HFvytbmNI:tJZKBI0FyYeY4eoiJ+sCFv1
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2272-133-0x0000000000820000-0x0000000000842000-memory.dmp vanillarat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs