S-400 RAT v3[.]0[.]exe

General

Target

S-400 RAT v3.0.exe
Size

12.7MB
MD5

542cc41975dee7a52105e85d9beb2348
SHA1

4fdee6991ef7cf7d5e316b0a362aae1a21ef1b1f
SHA256

d9bbbaacb5ff9eed8cce06136ca013f2446d35c2f1ea81c59caa33353dde9f7a
SHA512

123d1044af6e07317e08d9e3d070cacc649073b8652ea54de5fea615cde363c313198189528fc0bb2bfbd1bb9756e68d2d9ff9208ee7ad8748f7740593c137fb
SSDEEP

196608:MNydn44X12cuPRNynGGp0VJBAC2BqLTnbi1hGRuH:Qydn4Pbb0G40VJBn2B6Tnbi1hR

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
S-400 RAT v3.0.exe