General
-
Target
Rat.zip
-
Size
7.2MB
-
Sample
241224-1rejfaykdt
-
MD5
1db232e23cae8e66ad2b535845c55983
-
SHA1
2ac359ebbc5e3176208807698dd45086fabc71e4
-
SHA256
612394c6622beb5ff15677d86a6d181c1925f11c28f6ab442d6aedc552b87794
-
SHA512
c7064d39638eb4ae2655e87b29b69e55f822b5d96a1de5e996bfe3698ce73088b4ef3ff1976009da467af015c8ed0ef7b0caf9ca8d264ad5f0fcc8c85bf498b7
-
SSDEEP
196608:hHSEbSlprebj2fPAtKIF08k+yNBvzHXzvgJO:hy8Exef2HuzI+y3HjgJO
Behavioral task
behavioral1
Sample
Rat.zip
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
Rat.zip
-
Size
7.2MB
-
MD5
1db232e23cae8e66ad2b535845c55983
-
SHA1
2ac359ebbc5e3176208807698dd45086fabc71e4
-
SHA256
612394c6622beb5ff15677d86a6d181c1925f11c28f6ab442d6aedc552b87794
-
SHA512
c7064d39638eb4ae2655e87b29b69e55f822b5d96a1de5e996bfe3698ce73088b4ef3ff1976009da467af015c8ed0ef7b0caf9ca8d264ad5f0fcc8c85bf498b7
-
SSDEEP
196608:hHSEbSlprebj2fPAtKIF08k+yNBvzHXzvgJO:hy8Exef2HuzI+y3HjgJO
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3