Behavioral task
behavioral1
Sample
Ratelbgfhajhjcd10_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Ratelbgfhajhjcd10_browsingExe.exe
Resource
win10v2004-20230703-en
General
-
Target
Ratelbgfhajhjcd10_browsingExe.exe
-
Size
164KB
-
MD5
40afe8c95a3517ad07d3700ad46c2664
-
SHA1
814b57b21cafe24cc8adf3ce44d2de95e222aca4
-
SHA256
5887c4646e032e015aa186c5970e8f07d3ed1de8dbfa298ba4522c89e547419b
-
SHA512
a1d66524c9d87d9c90229f823e236527c0160631e16d84aed12ba008993b7579d27e14f282737c26c3cabddabfba9bfe2d7d02c37f122c77686a6f5d4837a99f
-
SSDEEP
3072:rEQVoB28fcPWcBDOug915w/hWmPl0ei30DS83ZV:oQVosQcPW8DO75wIOrXtZV
Malware Config
Extracted
bruteratel
d271p9yr247po5.cloudfront.net:443
-
c2_auth
NA0J84P9AASEF7HM
-
uri
/build_info.html
/build_info.jsp
/version.html
/esh_os_service/favicon.gif
/sap
/alertinbox
/bsp_dlc_frcmp
/bsp_veri
/bsp_verificatio
/bsp_wd_base
/bspwd_basics
/certmap
/certreq
/crm_bsp_frame
/crmcmp_bpident
/crmcmp_brfcase
/crmcmp_hdr
/crmcmp_hdr_std
/crmcmp_ic_frame
/crm_thtmlb_util
/crm_ui_frame
/crm_ui_start
/esh_sap_link
/esh_sapgui_exe
/graph_bsp_test
/gsbirp
/htmlb_samples
/iccmp_bp_cnfirm
/iccmp_hdr_cntnr
/iccmp_hdr_cntnt
/iccmp_header
/iccmp_ssc_ll
/ic_frw_notify
/it00
/sam_demo
/sam_notifying
/sam_sess_queue
/sbspext_htmlb
/sbspext_xhtmlb
/spi_admin
/spi_monitor
/sxms_alertrules
/system
/thtmlb_scripts
/thtmlb_styles
/uicmp_ltx
/xmb_bsp_log
/contentserver
/echo
/error
/FormToRfc
/net
/CERTREQ
/designs
/webgui
/IDoc_XML
/ping
/report
/ici
/rfc
/IDoc
/wdvd
/apb_launchpad
/apb_launchpad_nwbc
/apb_lpd_light_start
/apb_lpd_start_url
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Signatures
-
Bruteratel family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ratelbgfhajhjcd10_browsingExe.exe
Files
-
Ratelbgfhajhjcd10_browsingExe.exe.exe windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE