sliver | c994bb9982dd689598c6c261090a40cb[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
c994bb9982dd689598c6c261090a40cb.dll
Size 15.8MB
Sample240927-k17ctavdkm
SHA256 fbce9fc010fdfb67da5ff95cc5a5d1dbb0c07950522f130b031e55831f81b060
MD5 c994bb9982dd689598c6c261090a40cb
SHA1 484932042beb27bec5ab6d96df21ec1418c428a6
SHA512 32fa505bdca420313d62279874ac2ef1383a360502d73f0dfbe010913cc136c103159150b4706f46756e2d8cdea9a7442bc7d8c4cff58a67cfd869874044919b
SSDEEP 196608:rcRl1WLHnSCf24VHfaRpamWwSOsPlebA:8CLkGMadfNgb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
sample	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c994bb9982dd689598c6c261090a40cb.dll

File Explorer

c994bb9982dd689598c6c261090a40cb.dll

.dll 15.8MB

c994bb9982dd689598c6c261090a40cb.dll

IMPHASH 7d61210a06b412428471240387e6e605
SHA256 fbce9fc010fdfb67da5ff95cc5a5d1dbb0c07950522f130b031e55831f81b060
MD5 c994bb9982dd689598c6c261090a40cb
SHA1 484932042beb27bec5ab6d96df21ec1418c428a6
SHA512 32fa505bdca420313d62279874ac2ef1383a360502d73f0dfbe010913cc136c103159150b4706f46756e2d8cdea9a7442bc7d8c4cff58a67cfd869874044919b
SSDEEP 196608:rcRl1WLHnSCf24VHfaRpamWwSOsPlebA:8CLkGMadfNgb
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Sliver RAT v2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetEnvironmentStringsW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar PostQueuedCompletionStatus ResumeThread SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__mb_cur_max _amsg_exit _beginthread _errno _initterm _iob _lock _unlock abort atoi calloc fputc free fwrite localeconv malloc memcpy memset realloc setlocale strchr strerror strlen strncmp vfprintf wcslen

Name

.text

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

327KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c994bb9982dd689598c6c261090a40cb.dll

kernel32

msvcrt

generic