RAT[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

RAT.zip
Size

3.3MB
MD5

903beb9c404e734ecb94ff771df81a17
SHA1

a6d771037f370909e1637a683902a8fa2050e900
SHA256

a27ff09ec8cbc4b9bad0679d8922ed1dd22fbf9bcf472ba69c1e413e6785dfa3
SHA512

f4314bbd478c984e2da8cee39d60d78033e643ff9877b4758b8144f85b96c68d026f867d150f79c79bb0ce36b28cd63763e81c36c9cf8ec631d1dd447f094392
SSDEEP

49152:XaoQKZtf5ApLv4s+SelbXdkFgMxf4HuqM+QqKEUCPtppfIN5H3N55ztvhDbcqfpc:9tfeDmhXdckuXqxlPaD3xzt5XVnI

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
static1/unpack001/RAT/NetWire.doc	office_macro_on_action

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
static1/unpack001/RAT/NetWire.doc

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RAT/CrimsonRAT.exe
unpack001/RAT/VanToM-Rat.bat

Files

RAT.zip
.zip
RAT/Adwind.exe
.jar
RAT/CobaltStrike.doc
.docm .doc office2007
RAT/CrimsonRAT.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\hbraeiwas\hbraeiwas\obj\Debug\hbraeiwas.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAT/NetWire.doc
.doc windows office2003

ThisDocument

HauteGaronne
RAT/VanToM-Rat.bat
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 73KB - Virtual size: 73KB

.sdata Size: 512B - Virtual size: 312B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 12B

ThisDocument

HauteGaronne

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 169KB - Virtual size: 169KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 73KB - Virtual size: 73KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 169KB - Virtual size: 169KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 512B - Virtual size: 12B