888rat | 6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee

General

Target

6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee
Size

4.6MB
MD5

03e600a52b68709d073fcc01b2930a17
SHA1

68ff27b1ad790d0d123c6ce2e2ffa60ff6feaad9
SHA256

6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee
SHA512

be534814c0e392d0760c81a0f099579be1c6af0187cf5b20d624a35025ce0337cf2cff05a20e8076ee912d015bbfe757e086c8a2d40aa09570c4278c18ae2946
SSDEEP

24576:soxwJ8Bq6LQfdc91f1THyW9ML99ehUZ39ZjqkLX8in3tUXtqdHpiJrlEptOuVXgk:sGSfSxMbdPZbjJeQt3VXgoF

Score

10^/10

888rat

888rat family
888rat
Android 888 RAT payload 1 IoCs

Processes:

resource yara_rule

sample family_888rat

resource	yara_rule
sample	family_888rat

Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee

Office document contains embedded OLE objects 1 IoCs
Detected embedded OLE objects in Office documents.

Processes:

resource yara_rule

sample office_ole_embedded

resource	yara_rule
sample	office_ole_embedded