runningrat | 2b6bdd0a18e76a5df3a867a49f951125[.]bin

General

Target
2b6bdd0a18e76a5df3a867a49f951125.bin
Size 20KB
Sample240613-bqvrlaserm
SHA256 b3c555d1df6e80ea4826fad4acd96ca543e57276e15864a1d97d02dd913af707
MD5 736964fcab2d8e4fc3bfb3ceee193d08
SHA1 5c488fc9f1766b2d7a17f979d3e3091b00b64dc4
SHA512 2ae72cd703c4f0921ebf328fb4cfe4e347dec1a73945812a39bd3d5c4668ab9f76ef1931dee8728cc479c3b33d1522620ee5d3eb20db51de22ee1ece80245e81
SSDEEP 384:Uz5E5DFPgqpRMWV/fTV6NujKZede75ncNrFBWUQSgAegY+VRs25S6LejyA5r3KVC:UzQFpbFjKZede75nyFBWAgAegY+VJTIL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

runningrat

Malware Config

Signatures

RunningRat payload 1 IoCs

resource	yara_rule
static1/unpack001/b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f.exe	family_runningrat

Runningrat family
runningrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f.exe

File Explorer

2b6bdd0a18e76a5df3a867a49f951125.bin

.zip 20KB
b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f.exe

.exe 48KB

2b6bdd0a18e76a5df3a867a49f951125.bin

SHA256 b3c555d1df6e80ea4826fad4acd96ca543e57276e15864a1d97d02dd913af707
MD5 736964fcab2d8e4fc3bfb3ceee193d08
SHA1 5c488fc9f1766b2d7a17f979d3e3091b00b64dc4
SHA512 2ae72cd703c4f0921ebf328fb4cfe4e347dec1a73945812a39bd3d5c4668ab9f76ef1931dee8728cc479c3b33d1522620ee5d3eb20db51de22ee1ece80245e81
SSDEEP 384:Uz5E5DFPgqpRMWV/fTV6NujKZede75ncNrFBWUQSgAegY+VRs25S6LejyA5r3KVC:UzQFpbFjKZede75nyFBWAgAegY+VJTIL
MD5 SHA1 SHA512 SSDEEP

Password

infected

b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f.exe

IMPHASH 24ffff844f7eed74e1f1064cc9840ba9
SHA256 b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f
MD5 2b6bdd0a18e76a5df3a867a49f951125
SHA1 f0286405e8c8efb11ad4d30b29f32268ea747c09
SHA512 ef06c218ad5daf8437fda94c991a4ba86e3bdfd7ef55b64d8fdbe4657bb7acf512c42e7158cce17943a3aa437f96d294dae6eeb908d1f8acacdc4ddb25f27915
SSDEEP 768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ahPC:Ub1MsHz3JDwhyWr+N95OTga6Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RunningRat payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

10450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord815 ord800 ord537 ord2621 ord4129 ord5683 ord825 ord5265 ord4376 ord4853 ord4998 ord2514 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord2982 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord693 ord641 ord324 ord2302 ord4234 ord3996 ord4710 ord755 ord470 ord6907 ord3499 ord2818 ord540 ord2515 ord355 ord1168 ord2379 ord1146 ord2582 ord6055 ord1776 ord4402 ord5290 ord3370 ord3640 ord567 ord3998 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4441 ord4673 ord1576

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _except_handler3 memset __p__pgmptr sprintf memcpy _access __CxxFrameHandler strstr _setmbcp _mkdir

kernel32

CloseHandle CreateFileA FreeLibrary GetTickCount GetFileAttributesA ExpandEnvironmentStringsA GetLastError GetProcAddress LoadLibraryA lstrcpyA GetCommandLineA Sleep lstrcmpiA SetThreadPriority GetCurrentThread SetPriorityClass GetCurrentProcess GetModuleHandleA GetStartupInfoA WriteFile

user32

SendMessageA IsIconic GetClientRect EnableWindow LoadIconA GetSystemMetrics wsprintfA DrawIcon

Sharing