Overview

overview

10

Static

static

10

RAT control panel.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RAT control panel.exe

  • Size

    81.2MB

  • Sample

    241212-xnyw5atnex

  • MD5

    45dfbeb921c2ba334d5c2345974f5e37

  • SHA1

    1878b30e4a2e1e8bfa1c996ba7aef3aa740c90b8

  • SHA256

    0f60fb03dc45218372b8e0d174534e8295a8ded3894069162ba1c581a233eb05

  • SHA512

    f57f0137a0b34837756dda6d0d487280ab54477a0ff66eeb404b54f5c18112b181dd52cc997a737d056bcbb8af263cc99205081dfe423086f88b33ffc93724ea

  • SSDEEP

    1572864:1GKlXebW8smwSk8IpG7V+VPhqb+T9E7NliHiYgj+h58sMw5IRerWhH/cJFJ:UKRCbsmwSkB05awb+TwwZ5Foer4eJ

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      RAT control panel.exe

    • Size

      81.2MB

    • MD5

      45dfbeb921c2ba334d5c2345974f5e37

    • SHA1

      1878b30e4a2e1e8bfa1c996ba7aef3aa740c90b8

    • SHA256

      0f60fb03dc45218372b8e0d174534e8295a8ded3894069162ba1c581a233eb05

    • SHA512

      f57f0137a0b34837756dda6d0d487280ab54477a0ff66eeb404b54f5c18112b181dd52cc997a737d056bcbb8af263cc99205081dfe423086f88b33ffc93724ea

    • SSDEEP

      1572864:1GKlXebW8smwSk8IpG7V+VPhqb+T9E7NliHiYgj+h58sMw5IRerWhH/cJFJ:UKRCbsmwSkB05awb+TwwZ5Foer4eJ

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks