bruteratel | 196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1

Resubmissions

27/11/2024, 14:55

241127-sae5msxrey10

27/11/2024, 14:54

241127-r9z4esvjdk10

Sharing

Copy URL Twitter E-mail

General

Target
196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1
Size 233KB
Sample241127-sae5msxrey
SHA256 196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1
MD5 e7afaf7e063d5c07dbbc2bc8cd7832f6
SHA1 91c785431d3489743e59df2889b9c495443bc277
SHA512 e38684cbcbe6ae88c0cd98874231cbb34d67cdacb3c03d3f61cea61a1396b259be8a799c500bbfec2677788750c56fe36e6e4acf281107e5659eef814ebd2ce6
SSDEEP 3072:2Bs/p0Fq9NCotWnnPWDrfBcskSKGD4HUNjeFlGOBuhvgxgsZLqPXPCbUW5JbLVYO:WsxjCotWkESsWIusRuKbN513Qau81U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bruteratel

Malware Config

Signatures

Bruteratel family
bruteratel

Detect BruteRatel badger 1 IoCs

resource	yara_rule
sample	family_bruteratel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1

File Explorer

196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1

.dll 233KB

196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1

IMPHASH fcfbe5457e76d2ac347d7db113c0ca3b
SHA256 196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1
MD5 e7afaf7e063d5c07dbbc2bc8cd7832f6
SHA1 91c785431d3489743e59df2889b9c495443bc277
SHA512 e38684cbcbe6ae88c0cd98874231cbb34d67cdacb3c03d3f61cea61a1396b259be8a799c500bbfec2677788750c56fe36e6e4acf281107e5659eef814ebd2ce6
SSDEEP 3072:2Bs/p0Fq9NCotWnnPWDrfBcskSKGD4HUNjeFlGOBuhvgxgsZLqPXPCbUW5JbLVYO:WsxjCotWkESsWIusRuKbN513Qau81U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Detect BruteRatel badger
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

196b4d327d8cc1fab8d801c19872c0b084d7485aeb1a103396652ff40fae45e1

kernel32

msvcrt

generic