Overview

overview

10

Static

static

1

Gate acces...24.lnk

windows7-x64

10

Gate acces...24.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Gate access roster 2024.lnk_E4DDD5CC8B5F4D791F27D676D809F668

  • Size

    40.0MB

  • Sample

    240409-gm83psbf41

  • MD5

    e4ddd5cc8b5f4d791f27d676d809f668

  • SHA1

    506ffe6a5bb460ec943ee247c280de1dbe1775bf

  • SHA256

    c25e5e87d1e665197209e7aaec64e484ce30e2dabcc9e457c5593ac6c7bb5686

  • SHA512

    c59da52f56d84b1ef9d1d191978d3ba04267f4a661fd8f73f73e2c52cd70433f6b0f9ea977ad879dc4e44930789dce5765865e0b9d2a922888fc4b7c7222db9a

  • SSDEEP

    24576:/gRXTTYdy830QmOpIDjW7sFAcXMh5X2wV:/gj4CDa7n2wV

Score
10/10
rokratrat

Malware Config

Targets

    • Target

      Gate access roster 2024.lnk_E4DDD5CC8B5F4D791F27D676D809F668

    • Size

      40.0MB

    • MD5

      e4ddd5cc8b5f4d791f27d676d809f668

    • SHA1

      506ffe6a5bb460ec943ee247c280de1dbe1775bf

    • SHA256

      c25e5e87d1e665197209e7aaec64e484ce30e2dabcc9e457c5593ac6c7bb5686

    • SHA512

      c59da52f56d84b1ef9d1d191978d3ba04267f4a661fd8f73f73e2c52cd70433f6b0f9ea977ad879dc4e44930789dce5765865e0b9d2a922888fc4b7c7222db9a

    • SSDEEP

      24576:/gRXTTYdy830QmOpIDjW7sFAcXMh5X2wV:/gj4CDa7n2wV

    Score
    10/10
    rokratrat

    • Detect Rokrat payload

    • Rokrat

      Rokrat is a remote access trojan written in c++.

      ratrokrat

    • Blocklisted process makes network request

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks