888rat | 39915dc17d2bc1f53bdac0fc26373b05628734d2dacf3041669d2e6e68222064 | Triage

Submit
Reports

Overview

overview

Static

static

1

888Rat.zip

windows7-x64

1

888Rat.zip

windows10-1703-x64

888Rat.zip

windows10-2004-x64

888Rat.zip

windows11-21h2-x64

1

Sharing

General

Target

888Rat.zip
Size

92.6MB
Sample

240713-k14lxsvclr
MD5

3a32f6272a10e51f9e9ca370bd0739fe
SHA1

694794b3952f8da13b9e6bb8cfe0bc1dc55b6327
SHA256

39915dc17d2bc1f53bdac0fc26373b05628734d2dacf3041669d2e6e68222064
SHA512

bf8a884701c67b5eb17a88aaf4907d4f4cced8af30fe6a8cc906cd91542a19906c4f98aa29568407e24deb333536fd5bcb2e2fd368e22080d2217f9ff777bb36
SSDEEP

1572864:CGlu4mDMQuIR3O68liHx8LOac30Mcsu4uELQv2DSyT5BeMX6q9h06dRI3ejL01/U:B44rPgiiHx90B4uHCS45BDX6KpdMeP0K

Score

10^/10

888rat infostealer rat trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

888Rat.zip

Resource

win7-20240704-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral2

Sample

888Rat.zip

Resource

win10-20240404-en

888rat infostealer rat trojan upx

windows10-1703-x64

15 signatures

1800 seconds

Behavioral task

behavioral3

Sample

888Rat.zip

Resource

win10v2004-20240709-en

888rat infostealer rat trojan upx

windows10-2004-x64

16 signatures

1800 seconds

Behavioral task

behavioral4

Sample

888Rat.zip

Resource

win11-20240709-en

windows11-21h2-x64

0 signatures

1800 seconds

Malware Config

Targets

- Target
  
  888Rat.zip
- Size
  
  92.6MB
- MD5
  
  3a32f6272a10e51f9e9ca370bd0739fe
- SHA1
  
  694794b3952f8da13b9e6bb8cfe0bc1dc55b6327
- SHA256
  
  39915dc17d2bc1f53bdac0fc26373b05628734d2dacf3041669d2e6e68222064
- SHA512
  
  bf8a884701c67b5eb17a88aaf4907d4f4cced8af30fe6a8cc906cd91542a19906c4f98aa29568407e24deb333536fd5bcb2e2fd368e22080d2217f9ff777bb36
- SSDEEP
  
  1572864:CGlu4mDMQuIR3O68liHx8LOac30Mcsu4uELQv2DSyT5BeMX6q9h06dRI3ejL01/U:B44rPgiiHx90B4uHCS45BDX6KpdMeP0K
Score

10^/10

888rat infostealer rat trojan upx
- 888RAT
  888RAT is an Android remote administration tool.
  trojan infostealer rat 888rat
- Android 888 RAT payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

888ratinfostealerrattrojanupx

behavioral3

888ratinfostealerrattrojanupx

behavioral4

© 2018-2024

Terms | Privacy