Analysis
-
max time kernel
158s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 19:58
General
-
Target
888 RAT 1.0.9.exe
-
Size
22.0MB
-
MD5
32004e656640aad1672f0ee98434bc3c
-
SHA1
d665b4e03e9d75f87079d65cff791147b7ee6e4f
-
SHA256
beb837e8832f27dacfd3719cf617310f1b9e74badbfca8705ecafce3ed5e6a33
-
SHA512
1cd55008d6352469a937f168d6d72cfd202d81c24a6be4c6256a4c73c576577aefe8da912c5cb09e12f12a58e46f99381fa9834b58bc356e0c530908b236785f
-
SSDEEP
393216:TufwMCigvYFChWbRT5OV7lAUl+9o0okMLeDuq3+QAk5ubWWBwBvJ5wV:aXZgvYYhQDOVPl+9l2+OZuhQwR/
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 RAT 1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\888 RAT 1.0.9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143KB
MD565698140a9ee0eae6866f5cbfc7875a5
SHA11b28a0fa3a76554d5e51d3969c9635e273eca846
SHA256f9b2aeb3739dbaf71810906cbfec64610198f8daff8ebe11f0bce02921ae4d1d
SHA512afe38fe139d3399d0a6909fa81bd3287b8f3e8b4efee383b76e63fc18719dc0d983741402c18bfc986d81f4754157fd58d7947fb0dfec9794635a7fc486aa8e9
-
Filesize
1.4MB
MD5ce691d60d3d0ba3735bde01e861be8db
SHA17f15e7354524e332c2d5a2b200ba73bd38798ce0
SHA256830cfabaeef2915c0d75f0061456f7345ab3786345cf7d6b7bd34f807e1614de
SHA512e2e59e830fafcee8072325693ee95d5dc618c88092bb7b6ed65e671f3d78e41790354d9b5fd3a23df1e6b70aa19b7a28464a83fafb4c68ad54b0b83ac27b83e6
-
Filesize
1017KB
MD53bdcfdfc49edcfd7a044f184a643bb62
SHA16a0b422543cd4cd40a65dc111cb8b21b3b13ef27
SHA256f34b150309d9b6eb5c3047328d88e37dba25c2affae52054a7b8a1cefc7fe8ec
SHA512e523331595504805961c631d61571e7b8c4c10a998427be5944ece008c749dbd62c0ba26c46c6722865f0b4c4d8340800d2073e9a10e00db50d0a00cb652a02b
-
Filesize
239KB
MD5bc8a6f4d28474d90a687ed00a9b5b60f
SHA1c8a4c0816e2fc3d728f1a715ac6190b66f027e3a
SHA256b78c160c882d08f98bc209dd2722b4f01290dd46a19e0be70d21473dae1c8ff2
SHA512b90c9bcbfb08b1d63cd6066869896bbb13cfef15a6f30483e31868aca5b3c29150e71984ba3d07ba91da81d47a9d2dd29917851ec5bb04f8f463df113502078f
-
Filesize
748KB
-
Filesize
22.0MB
-
Filesize
488KB
-
Filesize
22.0MB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
22.0MB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
22.0MB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
22.0MB
-
Filesize
148KB
-
Filesize
748KB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
908KB
-
Filesize
22.0MB
-
Filesize
880KB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
844KB
-
Filesize
464KB
-
Filesize
908KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
22.0MB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
148KB
-
Filesize
844KB
-
Filesize
22.0MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
844KB
-
Filesize
880KB
-
Filesize
5.7MB
-
Filesize
908KB
-
Filesize
844KB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
22.0MB
-
Filesize
22.0MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
5.7MB
-
Filesize
748KB