Behavioral task
behavioral1
Sample
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe
Resource
win10v2004-20230703-en
General
-
Target
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466
-
Size
115KB
-
MD5
b76d1f217230723ebce9e7da6c141900
-
SHA1
988302be6face5989f5ddf9ea89594d38ba5a9d5
-
SHA256
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466
-
SHA512
1ba509c37615c2038f455a08bab976c88ff2670793e8bab1602c156f3a6ad7c83fe1ea6e24a02a6f7854c33f8bfc0dbd6ff7da62214a4ecee4ccdb0d83e27927
-
SSDEEP
3072:tJZKnPE2YyJzELtyTFyYeY8lNgoiJ+sX8HFvytbmNI:tJZKBI0FyYeY4eoiJ+sCFv1
Malware Config
Signatures
-
Vanilla Rat payload 1 IoCs
Processes:
resource yara_rule sample vanillarat -
Vanillarat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466
Files
-
a961abf44439a3468017388012b05bd26783d4d95ab861b3a4edef6db622e466.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ