Overview

overview

10

Static

static

1

b02329000a...05.lnk

windows7-x64

10

b02329000a...05.lnk

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b02329000ae4f8f4238db366d8fe394867dcad8222d02d9a76e82a376c6b1405

  • Size

    50.4MB

  • Sample

    240403-f356bahf65

  • MD5

    82f881a33eafee75fb1344432f76faf6

  • SHA1

    05f4fc5f51d2dc9c55e3b948f43297b2d1fda1d4

  • SHA256

    b02329000ae4f8f4238db366d8fe394867dcad8222d02d9a76e82a376c6b1405

  • SHA512

    93d61ca4d38383371ca5295ea74abd6f96eeb69a02af8eb67e78685a79493698e01f345333336b252082d300af31f0d8b21fbaff35fede3cf9c386ad9070f2f4

  • SSDEEP

    196608:xbtqwY5Dj6Y7GoxdWC0H3M3AXqIGPaJOmlvuoeL7g2BQ4m6BXhG2wf:G3/ao3WC0Hc3AaIGk/Ru7RDm6BX42wf

Score
10/10
rokratrat

Malware Config

Targets

    • Target

      b02329000ae4f8f4238db366d8fe394867dcad8222d02d9a76e82a376c6b1405

    • Size

      50.4MB

    • MD5

      82f881a33eafee75fb1344432f76faf6

    • SHA1

      05f4fc5f51d2dc9c55e3b948f43297b2d1fda1d4

    • SHA256

      b02329000ae4f8f4238db366d8fe394867dcad8222d02d9a76e82a376c6b1405

    • SHA512

      93d61ca4d38383371ca5295ea74abd6f96eeb69a02af8eb67e78685a79493698e01f345333336b252082d300af31f0d8b21fbaff35fede3cf9c386ad9070f2f4

    • SSDEEP

      196608:xbtqwY5Dj6Y7GoxdWC0H3M3AXqIGPaJOmlvuoeL7g2BQ4m6BXhG2wf:G3/ao3WC0Hc3AaIGk/Ru7RDm6BX42wf

    Score
    10/10
    rokratrat

    • Detect Rokrat payload

    • Rokrat

      Rokrat is a remote access trojan written in c++.

      ratrokrat

    • Blocklisted process makes network request

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks