sliver | 4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db

General

Target
4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db
Size 6.0MB
Sample240601-fg2wrsbb38
SHA256 4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db
MD5 0459fcb5723f9a7a5efa5ca82b94279c
SHA1 f3c4aebf2d12a201faa6227a658514ec17fd138d
SHA512 ab0c47d882ea1338dea7e6110ba1b1762b9fa9b34c87811d7dc8ed1b0c12686a9e74734cae52cc2ad8d03d479b0a66950bccac4cd05c78194c8db376eb123ee7
SSDEEP 98304:X/RznRHlCEfyRD6wEL1LEVG7CeDnIVG+UcNvzEurjBdDW82eoTZLFXvUlP0MPGV7:5zPIl6wEq6CyIRUcNvzE67MLF/3EGVs+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
static1/unpack001/4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe

File Explorer

4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db

.zip 6.0MB
4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe

.exe 16.5MB

4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db

SHA256 4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db
MD5 0459fcb5723f9a7a5efa5ca82b94279c
SHA1 f3c4aebf2d12a201faa6227a658514ec17fd138d
SHA512 ab0c47d882ea1338dea7e6110ba1b1762b9fa9b34c87811d7dc8ed1b0c12686a9e74734cae52cc2ad8d03d479b0a66950bccac4cd05c78194c8db376eb123ee7
SSDEEP 98304:X/RznRHlCEfyRD6wEL1LEVG7CeDnIVG+UcNvzEurjBdDW82eoTZLFXvUlP0MPGV7:5zPIl6wEq6CyIRUcNvzE67MLF/3EGVs+
MD5 SHA1 SHA512 SSDEEP

Password

infected

4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62
MD5 8a507369e99f1dfd5e592ef24ce405d7
SHA1 267da456c8bc8cbf3110b5f73e041c6c808e3c1a
SHA512 b448e7335ace1dc0b0499b1c4cddc3d45c40d81a0cb8ed6318feb8f8fc440a702853451ca71ce1d6a0e9fc9bc577a7f14e1c585a13867c2d3b43f105d721511b
SSDEEP 98304:k3ZBdNmCKndzMmyI2oVvT75e81UlcEtkxTHWf/z1OvH5EfKu47+4n:EP/mCa6a2oVvT75eybUkxTHk/zIvafK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Sliver RAT v2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

381152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

264KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db

4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

4ffc39d1d01b20d877cd41cccac06c5d34431be2acadf06684f960aaf75296db

4b2277b34d4ce7534faf3ea0bf752f4631426c766e04c1a65ccaa779e96c6b62.exe

kernel32

generic