Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NotARat.exe
-
Size
37.6MB
-
Sample
240626-pxr6yavdnd
-
MD5
c08c75f727168728b6f209fc4ec1a11d
-
SHA1
8d0e836fd93861097b98aa859564dacaac50b6fd
-
SHA256
2bef68392f825f8100b9b43ba618339786681a830f8e7729c60199b77a0c1d08
-
SHA512
71e909331412a7fdfad7e986bd1a9e150f9e012c5e12da0b1ee49b7f2c120fbba0dd7353b92150f9e83ff96c435333505f065ed7ff88e91f203869a8e90c93c0
-
SSDEEP
786432:R3on1HvSzxAMNmFZArYs0LZ3WLaTyicgQ:RYn1HvSpNmXm0FjTyLgQ
Static task
static1
Behavioral task
behavioral1
Sample
NotARat.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
NotARat.exe
-
Size
37.6MB
-
MD5
c08c75f727168728b6f209fc4ec1a11d
-
SHA1
8d0e836fd93861097b98aa859564dacaac50b6fd
-
SHA256
2bef68392f825f8100b9b43ba618339786681a830f8e7729c60199b77a0c1d08
-
SHA512
71e909331412a7fdfad7e986bd1a9e150f9e012c5e12da0b1ee49b7f2c120fbba0dd7353b92150f9e83ff96c435333505f065ed7ff88e91f203869a8e90c93c0
-
SSDEEP
786432:R3on1HvSzxAMNmFZArYs0LZ3WLaTyicgQ:RYn1HvSpNmXm0FjTyLgQ
Score8/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
An obfuscated cmd.exe command-line is typically used to evade detection.
-