Viral RAT 1[.]0 by Sameed[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Viral RAT 1.0 by Sameed.zip
Size 5.3MB
Sample240618-v4fpdaxdql
SHA256 66cf95fbd7e5d2adb54c7be2a49210ac98003bcaef668271a8692865389b840a
MD5 43043994e295ef352625a61364ef5ae3
SHA1 5a4ce6d1c081f53c4a2eb9ccb169bdbabd79324b
SHA512 e362399bbbad59fc26a6a3a7b6ce2c67a060f9739e91121943d1d604ea9e4e43bfd4ff3989cd427e23fcb122647ae4b299286ca745cb456fabe3d3ea319a66d5
SSDEEP 98304:9Mp7nfNmyMEQsUrZCejbLC1sJnz5MLOE7B5bxbBcG1MxZ0Mewg7LTuABAPW1:Kp7YdE/UrweXLJJl/E151br18ZFaHhBx
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Viral RAT 1.0 by Sameed/Stub.exe
unpack001/Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe

File Explorer

Viral RAT 1.0 by Sameed.zip

.zip 5.3MB
Viral RAT 1.0 by Sameed/Stub.exe

.exe 502KB
Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe

.exe 5.5MB

Viral RAT 1.0 by Sameed.zip

SHA256 66cf95fbd7e5d2adb54c7be2a49210ac98003bcaef668271a8692865389b840a
MD5 43043994e295ef352625a61364ef5ae3
SHA1 5a4ce6d1c081f53c4a2eb9ccb169bdbabd79324b
SHA512 e362399bbbad59fc26a6a3a7b6ce2c67a060f9739e91121943d1d604ea9e4e43bfd4ff3989cd427e23fcb122647ae4b299286ca745cb456fabe3d3ea319a66d5
SSDEEP 98304:9Mp7nfNmyMEQsUrZCejbLC1sJnz5MLOE7B5bxbBcG1MxZ0Mewg7LTuABAPW1:Kp7YdE/UrweXLJJl/E151br18ZFaHhBx
MD5 SHA1 SHA512 SSDEEP

Viral RAT 1.0 by Sameed/Stub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e693e05888147223f78c57a5d2a0bccc594af7e6f0d9c5d6bd8a0cb5d420a851
MD5 411062115f006fef08db4e7a8b35a08a
SHA1 c63c97aa1dbed7b62640698893b296339125d40f
SHA512 1bc8b85cd23cf55f3f5272db32b27af32499809f495144622a803c4312ba10433eb1653b9748c3b9cfe06e533aeb2a03052f0a2b0871e1ab623e654ed1a2137f
SSDEEP 6144:mRrXVpyQ5L9hYNuy1TEMzvwvzKe4P6gOrS9cav70BcM9HT+O0p5yl+aJI+bHgbDa:mrnF5j4TEm0g5psl+amz3AXSY/A
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

223982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe

IMPHASH 77d45b1ee20c3b020c48ab42d23ce5ef
SHA256 7bbc65ed68543a966e7b166f1e17efb4c1bea40a1d441b03c93f2c225a4c50b6
MD5 0d8a326d2676741da4e4506b0dc0614f
SHA1 cfdf089f3201d44b78248936a77c82dc1122a1ab
SHA512 debeeefdfe9e015b2bac1286bc959490ce0bee1da634f02aa61dab4f4cb2fb8abde69a1dc1680267f2f2e29c1d95afd0625b646b19945f573aa81ec59469a39f
SSDEEP 98304:fJnZwQl/VAQRxdsPKJ/lRM/oO3FX5Tz1m2HK1T2oAcEFZNOwBChw:fJWQl/GQDd3JjPOVXRzPHGTbarxBP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW CloseHandle FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW CreateThread LeaveCriticalSection GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer DuplicateHandle GetCurrentProcess EnterCriticalSection GetCurrentThread ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW DeleteFileW SetEnvironmentVariableA

user32

RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu GetCursorInfo GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic TranslateMessage SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate TrackPopupMenuEx DispatchMessageW OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW PeekMessageW ScreenToClient

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure LineTo AngleArc MoveToEx CreateCompatibleBitmap CreateCompatibleDC Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

UnRegisterTypeLi UnRegisterTypeLibForUser RegisterTypeLibForUser RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData CreateDispTypeInfo SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi VariantCopy VariantClear CreateStdDispatch DispCallFunc VariantChangeType SysStringLen SafeArrayAccessData VariantInit