General

  • Target

    Ratelbgfhajhjcd10_browsingExe.exe

  • Size

    164KB

  • MD5

    40afe8c95a3517ad07d3700ad46c2664

  • SHA1

    814b57b21cafe24cc8adf3ce44d2de95e222aca4

  • SHA256

    5887c4646e032e015aa186c5970e8f07d3ed1de8dbfa298ba4522c89e547419b

  • SHA512

    a1d66524c9d87d9c90229f823e236527c0160631e16d84aed12ba008993b7579d27e14f282737c26c3cabddabfba9bfe2d7d02c37f122c77686a6f5d4837a99f

  • SSDEEP

    3072:rEQVoB28fcPWcBDOug915w/hWmPl0ei30DS83ZV:oQVosQcPW8DO75wIOrXtZV

Score
10/10

Malware Config

Extracted

Family

bruteratel

C2

d271p9yr247po5.cloudfront.net:443

Attributes
  • c2_auth

    NA0J84P9AASEF7HM

  • uri

    /build_info.html

    /build_info.jsp

    /version.html

    /esh_os_service/favicon.gif

    /sap

    /alertinbox

    /bsp_dlc_frcmp

    /bsp_veri

    /bsp_verificatio

    /bsp_wd_base

    /bspwd_basics

    /certmap

    /certreq

    /crm_bsp_frame

    /crmcmp_bpident

    /crmcmp_brfcase

    /crmcmp_hdr

    /crmcmp_hdr_std

    /crmcmp_ic_frame

    /crm_thtmlb_util

    /crm_ui_frame

    /crm_ui_start

    /esh_sap_link

    /esh_sapgui_exe

    /graph_bsp_test

    /gsbirp

    /htmlb_samples

    /iccmp_bp_cnfirm

    /iccmp_hdr_cntnr

    /iccmp_hdr_cntnt

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36

Signatures

  • Bruteratel family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Ratelbgfhajhjcd10_browsingExe.exe
    .exe windows x64


    Headers

    Sections