Extracted

• • Target

    b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe

  • Size

    68KB

  • MD5

    04485ee0f0313f990255aa4a06546abb

  • SHA1

    fa87b9a7b914c11fb75b775e391a3ad46d4eb432

  • SHA256

    b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867

  • SHA512

    d95011d0bbae4c63ab0acf26568d0759990f26ed87dbc60ed01fdb840477519adb931feff6a6029c0b32d4ba4623ef2951ca260fcfabc609b364f51f775f024b

  • SSDEEP

    768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMI4V:BHJaAoHoc2x7bZoYBAcQlwJdME

  Score

  10^/10

  runningratdiscoveryratpersistence

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • RunningRat payload

  • Runningrat family

    runningrat

  • Server Software Component: Terminal Services DLL

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2