Analysis
-
max time kernel
149s -
max time network
90s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
24/12/2023, 19:58
General
-
Target
888 RAT 1.0.9.exe
-
Size
22.0MB
-
MD5
32004e656640aad1672f0ee98434bc3c
-
SHA1
d665b4e03e9d75f87079d65cff791147b7ee6e4f
-
SHA256
beb837e8832f27dacfd3719cf617310f1b9e74badbfca8705ecafce3ed5e6a33
-
SHA512
1cd55008d6352469a937f168d6d72cfd202d81c24a6be4c6256a4c73c576577aefe8da912c5cb09e12f12a58e46f99381fa9834b58bc356e0c530908b236785f
-
SSDEEP
393216:TufwMCigvYFChWbRT5OV7lAUl+9o0okMLeDuq3+QAk5ubWWBwBvJ5wV:aXZgvYYhQDOVPl+9l2+OZuhQwR/
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 RAT 1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\888 RAT 1.0.9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5333ae812917581948371b4694450ce7a
SHA1540465d2d791e4747c7986245d1ee8cbfd6c9c99
SHA256aa9836576619ee2104fdc7516e6a2bbe20d76eed05f59c250d0a320da98e031d
SHA51289ff4d10ae37fdc02fb9bdf72e9684a07e52bf92bc95b1eb1ed2473c51a68e912e7e95247c34ef09563478a58eaf2affe142e5e44ec068bb5917851f5a71a407
-
Filesize
50KB
MD59a99dbf568451d2bbb455f39cee11482
SHA11fe0b669e77cce0a0554d834e2e5ceff9b6a8992
SHA256c4f10850dc769b5c27ca9d27675ce5c6a4420fb0b9ae17183be1bae54b2a085f
SHA51241dc3b528dd88f5ce5d5bf0b4f1154ab3d777ce65dba21491ab65bb1a19515a406e15a902e51ee7eb750b908d68ebda3ee468a0c55447a393b7a845ca293f769
-
Filesize
65KB
MD512bd5cd724825a8577d24f4bb2ff53c7
SHA188feac4489258e94c022fd9772b657fc332bce71
SHA25670d3f7ae1c0b001c5e98645ff11f4fcb4d2acce3d82c79d4b370a1be8e02d2c5
SHA51264dff551bc407b79e1ee352d7edef1ea3c8e5c3880754fbb2531591b269e32db5f847d9de46f3eaf0d5050a9c974df0c4b6deb584e3dc562389afc5b43671ec5
-
Filesize
69KB
MD564ebd68a26010f3171917eedcf45ec8d
SHA1dcabdf1c1945793cb9a23ec21771c8b223ba4a28
SHA256ed246ac2782948b73966d5374c1abea98ecb39062012588513e0e2a9048aff1e
SHA5127e04b2c5b601d3ff0800dc9201fe7772f4389b9acd317cf014d43a5d0d821354be87ffcd5b9aae36eef9919e1c5fc5ea0ad55af9c69e52fa318a931d05211beb
-
Filesize
748KB
-
Filesize
22.0MB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
22.0MB
-
Filesize
148KB
-
Filesize
22.0MB
-
Filesize
496KB
-
Filesize
22.0MB
-
Filesize
148KB
-
Filesize
496KB
-
Filesize
22.0MB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
764KB
-
Filesize
1.3MB
-
Filesize
148KB
-
Filesize
22.0MB
-
Filesize
6.0MB
-
Filesize
1.3MB
-
Filesize
520KB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
520KB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
520KB
-
Filesize
6.0MB
-
Filesize
764KB
-
Filesize
22.0MB
-
Filesize
22.0MB
-
Filesize
764KB
-
Filesize
892KB
-
Filesize
520KB
-
Filesize
1.3MB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
520KB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
520KB
-
Filesize
764KB
-
Filesize
22.0MB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
22.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
2.1MB
-
Filesize
6.0MB
-
Filesize
22.0MB
-
Filesize
2.1MB
-
Filesize
764KB
-
Filesize
520KB
-
Filesize
764KB
-
Filesize
22.0MB
-
Filesize
2.1MB
-
Filesize
764KB
-
Filesize
892KB
-
Filesize
748KB