�C`<�X-vCtX����IDZ;�X���!B�w}���?E^�>�V�b��s`ѓM��l"C�� �+G���f����k���d��bp��-���j�7�3������xo�w� ��v#�{�$ҒO��#�Ib>AZ�j��"N��k��h�og�(�-��`�$��;�vߺ�UX!J K!?�N��Z���V�|�6�ֽ��^��7���*��T�w�27���Pc�&[�Yn�`dN�C�,>�J��1L��a'rشv��g��c�`6)u��|�M���B!�溷������ê���-��/7k��'+�AR��nS��a�1��]]�=��ո-bv(�$N����\$4\xԔ��)���P����j0�c]t�G��iKޛb��" ?�� �9�M#���oo������Y���'�O|��������<)E���^4CuO���K�\%�k:�I֏ G^��y^Rn�J�+��{$���$eJ�U��e32�c�@/3]�a�ݸ& �o���v_[lr$ �z��Cd�5d�7�Y}�j<���N�U�7�p���*ay;Ӻ`f��}�·��o�,N�#L�O���y��}P�����@J��U�60aF\��i9��Ƥ�`���cXg�� �+_>�ka3�=�n|�������e�o�����S�,i�a['z|ݧ�I�7�:7S�}�W�~��D��>�^�'�-�(Γx�Q�8K:��a����'Ԗo�u�Y �`y:�Y�ޔތ:? ���u,ʾ�:.�%h�����PI�X@щ�����y=>H~�ԩe쥻\1>3�r$F$�B���(.+-{�35w�k����s��!����C@��ѽ�K��{S[2G�LO�XL�hE�I��63�J߽���"�'6������st � S��u���Z�g�-���-$��S��ζ?A���,o�v�����f�~�4j��s��U���Ҭ܆��|9���s1*j�n�R�-Er� *$.&¯s�K����i�|�*��X��|o`Dp�t=��w4���ɟ�������L�� �xe���Ǣ�mP3��s�WBB>�Q�!�����Rīy��#H���6��9E�I����������y�v��5����۫~s�1��uz\��0��D-᪗T�����5��V�Ù��!�P�V�[�$d�o]r�D͔!�6g6���W���G����+����?\����,/�m4�t)h���:깆+3<���-��z}�TiF[�v��{˂z��4w+a �\`/�1t#CaLG+Q��>:�k�}�fD���P��d�x�P^� t�ו�v4�7e�z>d�iK��Ψ���AF�q��E�����j�)����O,�U9$=H�G6%��kq����b�4�(����+�_��+�8�[�X�Po�;���~s�����c�c[�b�c����b��kg�}��u{�Dg��Tx��2�a�xåD2,H����i�b9���z�X|AN��b�;?nz��*w�8���zY�ם"�?LyS�� O��D�5q��m��P�ti+SfM�?7UڻN�Z��(�H�.��w fh��.���G(;U ���r��ec"�r؍̀?�Ō�]E��I�F��y]������t��U�y[�9��X��I$�R0�d(��s��q����1q�N���K�By9�� �Бޞ-h(�. �G ��,��-�[�5��+#�ccF* `o������E_�}$TG����8��Y4�V�4��Ub����Z��3���h�V����p����f#O��B���;��_�d��h�t��y����P����D�f<Nbl9b�c��H�w��K��$��Qc�gl�YC���r� +�5[�^���6�a�{G�M�{,P�=-�������L�O<I��l������gHÇ��XL�NJvO�$龎@��D�pM���<T�����Lq������x�,�hhJ3t�2�?�����Y�j �(h3U}�q�@q#�*O�r-�)���G��]8�&�j�Ԓ:P.4�Oӄb��7�Y|�|lD��Gtf����/S5�!;Q�uE�4Hs�����Z���Ù�����m]7p�DY�J'8�&�XSz`n�0�o��I���!Ī��d2d����y0T5d���J�.���V��n���d1܃"��@N���0��9�b-p��뺄�z��!3�����d6-���7�� ��P����~��!/�pI�ld9�f�y�Rla�mt--7W����scu� ��b���d�4�{Ʀ�$�qB���Y�U�ؓ�����4�71��_ ����z���m����cE�4��h/j "�XBz�- %0Z�0&@[b�׆L��F$�����B�\�i� RKㄜ����K��O*�s s�@ê�u�q��e�ר�j��X���78)�;^�Y?�8�)�FX�3�۽7�n��(��!�;Q�%)aO�Ǜ�}�g�Dg�㡷5BK ��|E��ô'�g,T�wz*��>�,o�<�N�{�dJv`��˧a��;ß��/w��3�"���u�<�u����hNiy���`y��TA�c�K� ��5:*G�� ��k���+����pF�.����V��sy5ip#bH_i�/�g�^�������iP*"aN��)P�w��˘��u!�d�F����Y :x�9��nq�u������!se�m� mv[��*%����� �h��p������� B�%��V솆��[��ı��R��)X�_��N3��2E��Lv!] ��S�w=^0����('��C��3�������fk�J_ �l�����K�"�C_���U��,>��*��Q���`���mS�P�TXuW�>��+w� t��"-��V�����%����9-��� ��C�m�ꀿm���i��%j�����x[l5�����~!s��?gs1�r�&�@��7�r���u��D�� q�A���CPq�sK�o��p�������C#I^V�,��*=� O��vđZ�+� 3�\ �� �V� �K���{�俤Փ��*��
Static task
static1
General
-
Target
Ragebot.exe
-
Size
9.0MB
-
MD5
071322f5480e4ffd1d561247f2442539
-
SHA1
d26cc14322ba34be132f046b8f91797aec789de1
-
SHA256
f842dc177f3ea52e22379f7a295b1abb4a3cbc2ed8af7bc708529687593b72a8
-
SHA512
99b06331fc4971eefe3ac6f3f6a8d891cd07236f567d4a57a75da17d7fa777bd652093cdda9cec59b28ef9fbe972afaa6d0909e7895691b77061d9c82cbbd4cb
-
SSDEEP
196608:cQoDUrCRxtfrXzNILv+0JM1fxJBH29G/W51bmMwBobh9MU:cQu1fNILv+0JMPJBwmMwB6hO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ragebot.exe
Files
-
Ragebot.exe.exe windows:6 windows x64 arch:x64
77bc9686142052899c97d01e2b54c342
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 444KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.O=c Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.+DR Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Nom Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ