sliver | ea33b7eb965d8b552a75349946963151[.]bin

General

Target
ea33b7eb965d8b552a75349946963151.bin
Size 5.9MB
Sample240601-d7z4ragf3t
SHA256 c376a2981fb065f44daca51c0714adc3e3f40701ccfb08d21004b65619e1ebf9
MD5 e53ae88d5615653c365cefe366302264
SHA1 6c4a83660bde9b3d204db14d1b915179f197c81b
SHA512 eea4f4ecc6712a6ec0a1f62cc0bb40e3e324938e718e993edbe6869790d1fb5c958eb8b3e68ff4912c2cba8fc6ccf08506969eed33faffcc2be39f6fa077440b
SSDEEP 98304:5tMuIlMAb9WZXlXux7P/raFd4H2GrU74941AItzIALALwsF7l87RlebZ:5tMGXGDraFd4H2GwUSOIJIZLl8NA9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
static1/unpack001/252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe

File Explorer

ea33b7eb965d8b552a75349946963151.bin

.zip 5.9MB
252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe

.exe 16.4MB

ea33b7eb965d8b552a75349946963151.bin

SHA256 c376a2981fb065f44daca51c0714adc3e3f40701ccfb08d21004b65619e1ebf9
MD5 e53ae88d5615653c365cefe366302264
SHA1 6c4a83660bde9b3d204db14d1b915179f197c81b
SHA512 eea4f4ecc6712a6ec0a1f62cc0bb40e3e324938e718e993edbe6869790d1fb5c958eb8b3e68ff4912c2cba8fc6ccf08506969eed33faffcc2be39f6fa077440b
SSDEEP 98304:5tMuIlMAb9WZXlXux7P/raFd4H2GrU74941AItzIALALwsF7l87RlebZ:5tMGXGDraFd4H2GwUSOIJIZLl8NA9
MD5 SHA1 SHA512 SSDEEP

Password

infected

252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd
MD5 ea33b7eb965d8b552a75349946963151
SHA1 90f7aec1532504a4352c762ac61a851ecf7197f0
SHA512 490a6392b6d29bd8673334981fbb37e52f537c86cb98419cf35f7aea77356ac85719385ac187eae6d9a302f665a0b2434eaa4ed2b9cc528ad7866be596d0210e
SSDEEP 98304:g3W//YeQrtEbqfwvAxZ8yK52651lCk1CdVWbZQEXgCMXqcKg1OGiQbxEJLSao:4W3cfwm8Z5xblNAdVWTXAQo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Sliver RAT v2
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

6

Entry point

381152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

264KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ea33b7eb965d8b552a75349946963151.bin

252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

ea33b7eb965d8b552a75349946963151.bin

252a1bc6e1b8149ed56effc96444de8fec8afb79b74774c6fd7ecd81306a99bd.exe

kernel32

generic