General

  • Target

    Herasima RAT (2).zip

  • Size

    48.7MB

  • MD5

    88349cdc255a5ee4a03522ca6721d522

  • SHA1

    5ec9473fbb42f43c809da9adeedfb3433a988fa2

  • SHA256

    3cf1e56dbd4b08ecec80e9795ebf212d1aad7ef03bb7a92765a58582f46b14f3

  • SHA512

    a2bc77149b86242c6e54d738175b7afb02c2e2c1d9db02223d26619b19e686ad0732f2efe50c1f8c95e5921abccb9bf58a9da0c08800da6a56685e9d1db624c1

  • SSDEEP

    1572864:FxVS2XAK/DphNTBIZ2I9soTtWAmYNZn8kDHT+DGp:LQKbp3TBIZ2usoTtVHn8kbLp

Score
10/10

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • XMRig Miner payload 2 IoCs
  • Xmrig family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 55 IoCs

    Checks for missing Authenticode signature.

Files

  • Herasima RAT (2).zip
    .zip
  • Herasima RAT.zip
    .zip
  • Herasima RAT/ConfigBulid.json
  • Herasima RAT/Confused/Server.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Herasima RAT/GMap.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/GMap.NET.WindowsForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/IconExtractor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Ionic.Zip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Maps.json
  • Herasima RAT/MetroFramework.Design.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/MetroFramework.Fonts.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/MetroFramework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/NAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/AutoRun.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/AutoTask.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/DDos.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/FreendConnect.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Fun.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Images.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Keylogger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Map.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Message.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/MicroPhone.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/MinerEtc.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/MinerXmr.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Netstat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/RemoteCamera.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Scheduler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/SendFile.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Service.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Shell.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/SpeakBot.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Stealer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/System.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/SystemDisable.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/TaskMgr.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/Uac.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/WormJoiner.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Plugins/WormSMB.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/Server.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Herasima RAT/Server.exe.config
    .xml
  • Herasima RAT/Stub/Client.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Herasima RAT/Stub/UserMode.obf.dll
    .dll windows:6 windows x64 arch:x64

    6dbf95d81ab0cb2039f47259ddec333f


    Headers

    Imports

    Sections

  • Herasima RAT/Stub/WinRing0x64.sys
    .sys windows:6 windows x64 arch:x64

    d41fa95d4642dc981f10de36f4dc8cd7


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/Stub/ddb64.dll
    .dll windows:6 windows x64 arch:x64

    2b41a6eaabd449bd2521813e69f0a7c6


    Headers

    Imports

    Exports

    Sections

  • Herasima RAT/Stub/ethminer.exe
    .exe windows:6 windows x64 arch:x64

    601d901af8200f541117a59e7736bfef


    Headers

    Imports

    Exports

    Sections

  • Herasima RAT/Stub/fds.dll
    .dll windows:6 windows x64 arch:x64

    6dbf95d81ab0cb2039f47259ddec333f


    Headers

    Imports

    Sections

  • Herasima RAT/Stub/nvrtc-builtins64_112.dll
    .dll windows:6 windows x64 arch:x64

    8f855f48184bff75de5ed8f701a5f778


    Headers

    Imports

    Exports

    Sections

  • Herasima RAT/Stub/nvrtc64_112_0.dll
    .dll windows:6 windows x64 arch:x64

    4ca0827c1b67fe072d17a90113be5a0b


    Headers

    Imports

    Exports

    Sections

  • Herasima RAT/Stub/sigthief.exe
    .exe windows:5 windows x64 arch:x64

    ba5546933531fafa869b1f86a4e2a959


    Headers

    Imports

    Sections

  • sigthief.pyc
  • Herasima RAT/Stub/xmrminer.exe
    .exe windows:6 windows x64 arch:x64

    14ec8f3f7eee2e31d6dc574514386b4d


    Headers

    Imports

    Sections

  • Herasima RAT/System.Buffers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/System.Collections.Immutable.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/System.Memory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/System.Numerics.Vectors.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/System.Runtime.CompilerServices.Unsafe.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Herasima RAT/Themes.json
  • Herasima RAT/Vestris.ResourceLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/cGeoIp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/dnlib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Herasima RAT/protobuf-net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections