sliver | 99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5

General

Target
99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5
Size 6.0MB
Sample240601-fgxxtabb33
SHA256 99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5
MD5 dc6a764b51d58d40c440526ac25fa514
SHA1 c3db9e005cd6c98d6e36255dde8eb0ef7989d6ca
SHA512 38dd1fbfcc91cc3ee412487e5c85d0f53452c9f4906cfd62df5b08c9024d95efe8e02c40fb6a300cc15ad46d33ec042ff952528234bb00fc1dc503649ad423d3
SSDEEP 98304:VQxEM+Ym61fBukWurYI2znAMTBh7jnBIBV+pyPtI3ww4KLm1LNOMb4wSAIjqGEby:VNuBuHI2zAMtFrqgyP+3ww4e+hOS4UIj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
static1/unpack001/fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe

File Explorer

99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5

.zip 6.0MB
fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe

.exe 16.6MB

99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5

SHA256 99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5
MD5 dc6a764b51d58d40c440526ac25fa514
SHA1 c3db9e005cd6c98d6e36255dde8eb0ef7989d6ca
SHA512 38dd1fbfcc91cc3ee412487e5c85d0f53452c9f4906cfd62df5b08c9024d95efe8e02c40fb6a300cc15ad46d33ec042ff952528234bb00fc1dc503649ad423d3
SSDEEP 98304:VQxEM+Ym61fBukWurYI2znAMTBh7jnBIBV+pyPtI3ww4KLm1LNOMb4wSAIjqGEby:VNuBuHI2zAMtFrqgyP+3ww4e+hOS4UIj
MD5 SHA1 SHA512 SSDEEP

Password

infected

fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5
MD5 9cfae68caf4b61735e80d67f0d40783a
SHA1 7f2ce9678016688328e42cecb90341a01dff20bc
SHA512 22c50e8748f422811359e71521d6891bde33a2d610b3fa10ef7d9db983c6a0efadde54e967bcdb92cfab3db8912786deec0633969ed061b5f0f98c0aa3bb5ca1
SSDEEP 98304:s3cNeCY/7PND1UVrTSlGUny/mSzBtxf8q0Rm22KoptJZ9EyiNK5RduJo/r:8cNuUAoUnvS1txf8q0Rm22KHyiM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Sliver RAT v2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

381152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

10.1MB

Virtual Size

10.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

264KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5

fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

99b4b13a7e513c8c13a355b4c2e5f1ebcee434347f1b21d1ccf1cb40194180d5

fa6c448d06b7efba6d47b5c4ee041e24d7730aa5247befad498b636304e894d5.exe

kernel32

generic