vanillarat | Release[.]zip

resource	yara_rule
static1/unpack001/VanillaStub.exe	vanillarat

resource
unpack001/VanillaRat.exe
unpack001/VanillaStub.exe

Release.zip

SHA256 b10ec240860d0609b586f9ef4c2488651110e760872c5e5883c9d310c536e80f
MD5 a4859bf05e31b3b29dd1da902c2ce6fe
SHA1 22b5baa098f85b9dcd944162888dd05a338d130b
SHA512 490b873e3b9e4e766f9202d2e73ffb08e50e207e0efa9ba5c02625e34abfe8001fa866d46bd4a1e1bcc93e0fd62cd45106701aa6053a97553ecfd27543b65b22
SSDEEP 24576:CJuc7Y9w2LJy3Ggn1Qn5F+t7tRrQf8VRAl:CJuc0zIZun5Fk70fr
MD5 SHA1 SHA512 SSDEEP

VanillaRat.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0fe257c142a900fe69dd5ff1ebd56a9c073c977442173d823f90981b77e3c210
MD5 ce012d13bf11b47e0b8d1cf2d2ba9846
SHA1 4a554c01352281134eb95ac8f7534468e250c50a
SHA512 b9a931458c2562b414fd4b90b859ebf2d8c09f9fee6214d3523b3fe57e640c7c2316dd604eb0b307739ef90c265789913f7f6b6da3cc9b086d995bb0efadb799
SSDEEP 12288:+rzh887PPRqUy3G9nc6NghhkuqmzMarPPXj9RAyJ07lPFgoZ7+B:T87PPEUy3G9nLCnkQzM2UtzZa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1011630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\dhuin\Desktop\Projects\C#\VanillaRat\VanillaRat\obj\Debug\VanillaRat.pdb

VanillaRat.exe.config

SHA256 210f4349608cc5a6fe6448cf003298e96561aeefde1e50a17d2e2ca82c1912d2
MD5 eb293de8c2496a09204fcfed07cb8a10
SHA1 ce6e170fa910dc4ca53670b091dd82ac7ef3741d
SHA512 0b3c4b7f935d000456d5cf33740281ebd7e3d3123587d064268f86ca4ab3e52d9d4a0e68b603fc18d89d33c866ba8dfa57828e49dc91c5741e7cc3ae663cac5f
MD5 SHA1 SHA512

VanillaRat.pdb

SHA256 b518f6fb511b7beeca9b6ac9b70d2b7c1721ed3a201f140ccf408ea991903b22
MD5 8ed211da08467e8405cc16684ce0280e
SHA1 7ae68c780691152bf5266c35a8bf506662667c78
SHA512 60537e3396c2685fa9f72cd9a22f45465e5ff01eafb14b7175960b26bf108b19b50471389a1cc75b6825dbb81948a684898582637c4905d6d54a2fcf74bc1bab
SSDEEP 3072:HBp2UjW2gUcFgjEsGSWEJaZttX6a0OrI:HBp2UjWqcF+EsGSWE4ttX64M
MD5 SHA1 SHA512 SSDEEP

VanillaStub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 caba6c8f198ca5ec08ece1687210e756b860c90ecc32b49ef38a1a7d14524abe
MD5 185526401b0a3a083c797cac3598051a
SHA1 a3a4c4fd2b7f07843e0ac8eeb62b2c8871421b4f
SHA512 ea4f5e217be971950a05bd096dd526f40958ed2b92cbc62a21a83d258b665f35b13b32809b9cf4751887c743e1f58aaebecfab5c3b6ac1ed8e5bd968187adf3f
SSDEEP 3072:xgFtDHh9m0xajuYXPiKo3s+DXgHKv8mbIXC0LtyTy:aFRh9mEaKHS+DeKvYSE0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Vanilla Rat payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

122574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\dhuin\Desktop\Projects\C#\VanillaRat\VanillaStub\obj\Debug\VanillaStub.pdb

dnlib.xml

SHA256 c977ad2cd6377e9a51b5d66d3a23913116dd134f6088e6fd87e4c366fce71430
MD5 100a03225c14e7261b531a525ad6dfbe
SHA1 bf4a58ffd2b6815f79046ddbd0cc215c3e0f2e3f
SHA512 8796210434fa41e84a3f3a3628e84e83d9c0af32b142e530fa2de766154b3d8085bae1f3b8f248603a52ce380244d4d1faa34663aa6886b2b9b4512803469dda
SSDEEP 6144:IE0VzhYNTYd/jgy5SAy6l9CREF/jOn2WB:GhYNTYd/jg9Ay6l9CREF/jOn2WB
MD5 SHA1 SHA512 SSDEEP

Release.zip

VanillaRat.exe

mscoree

dotnet

VanillaRat.exe.config

VanillaRat.pdb

VanillaStub.exe

mscoree

dotnet

dnlib.xml

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Release.zip

VanillaRat.exe

mscoree

dotnet

VanillaRat.exe.config

VanillaRat.pdb

VanillaStub.exe

mscoree

dotnet

dnlib.xml