silverrat

General

Target

SilverRat.V1.5.rar
Size

5.4MB
Sample

250213-bnc4rs1nez
MD5

98e17376564e59ef92ebb3c86fdfc2b2
SHA1

fc8e9a0f70fd1402ad8ea4dafc59b2064ab3da44
SHA256

bef64e21cbc611550b7ac61d9323858cdb845f1307d6466b93b6bc7a1088c4eb
SHA512

79dd6d9c84702995f011f163d85433425360a5430890293c7a29df27b4af61096c8d687f2d7e8c69bf692d470042a52b14319fa465661562069ca588542cf1b8
SSDEEP

98304:HKGSyxNgUPQlhBkSkpmuRGrOvbEwhqB347Es+OMlm4paaH10hbcKoKzGrA2Xmsr1:qGSyzgUPOvkSkp5RlTEwY347ZjMky6yH

Score

10^/10

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

auto-london.gl.at.ply.gg:51655

Mutex

SilverMutex_kTAAZjMenK

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1253749007772160090/mxExcAUGlJgTCbYOk_u7JJAnNpsIhMne5e0PjqkRY2MV_40Bgpix2Ezib84aFxRmN66j
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
QnZ2VW1rTFlUa09ESXhCRkdHYURSSlBBdk5SQk5J
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
0
server_signature
RMCh38rJRIwRMYf2Sbpd9BzSePeTpscme+fLNDX9Bf6O5IR+EWvJS971m1lprJ/vpdLYQPZIImuX69267sqtVY2b3yH1lw7e7EZaXIHsGFR2uyeUjLQeAjD47DWaaKkGg8wKKEQ7AX8lBa1tYmqDorMfwQ9K2xlGjrxnS9ZotbBaz/KmFDUSwnUEWc6K5tKdqXQ5scv4Iejt9hGqjIxCo1c3AyRwr1eezKhGK66t4Y1aPVfqkIwuI23vWEPPjJYRDn5dWq5EykrPUBvH+OORD9xrQmM63F/gLb5d5/LlrOqSfkd5/yTv8YROpQfzMAYH5k10o6P4I+oBlGpJ9MwzL5Y4JBHSJyiG/m9XuEYKxe1zgffuIhU/xo30i0YC/hkKd5U8BP5k6PdZg9OLI+a8k7sa4/Sk/9Zkjx27VuOZdZs8IMP9t8mumexIqz2fvkwSO79gNHehbK8Y1feAFrlzCMoxK06XKuMRCyGOPse3sNm57TPHUBbk5yhteOGujQ9402QViU3tL9ZQR4rN71H4CBlNHaHbc0PO4+WhgxaAkr3W2/OOCyoaGrX1Kv18VFwwqB9Gqj0wG0MsA+femZUx/+SY41jQ715JwPCrD4aNkKu7xrjYnii+JjVsgNqaLVOhWv1VjL3qkCJ9kf0c7ob8qNOXaePlpZmHsWg/fgChnAk=

Targets

- Target
  
  SilverRat.V1.5.rar
- Size
  
  5.4MB
- MD5
  
  98e17376564e59ef92ebb3c86fdfc2b2
- SHA1
  
  fc8e9a0f70fd1402ad8ea4dafc59b2064ab3da44
- SHA256
  
  bef64e21cbc611550b7ac61d9323858cdb845f1307d6466b93b6bc7a1088c4eb
- SHA512
  
  79dd6d9c84702995f011f163d85433425360a5430890293c7a29df27b4af61096c8d687f2d7e8c69bf692d470042a52b14319fa465661562069ca588542cf1b8
- SSDEEP
  
  98304:HKGSyxNgUPQlhBkSkpmuRGrOvbEwhqB347Es+OMlm4paaH10hbcKoKzGrA2Xmsr1:qGSyzgUPOvkSkp5RlTEwY347ZjMky6yH
Score

10^/10

silverrat defense_evasion discovery trojan
- SilverRat
  SilverRat is trojan written in C#.
  trojan silverrat
- Silverrat family
  silverrat
- Downloads MZ/PE file
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
behavioral1
- Target
  
  PASSWORD.txt
- Size
  
  80B
- MD5
  
  2ac0fc5be470980cd28b52c281cfd331
- SHA1
  
  0f1ee5a9219c93af32a35418f3e0f62b4bd0208b
- SHA256
  
  5f2d5bb3b62f9000ac18b6da532ddc2b8b99b2b05b5def30001f00bf053b4778
- SHA512
  
  abe318498702759d860375180b0f109a2e0badf94aa19db7a3df073954cc686febc0192d5b9180b3867b0659c0e447207d668b91e0d0189d1f2eaddc741a2c4b
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral2
- Target
  
  SilverRat.V1.5.Re.Lab.rar
- Size
  
  5.4MB
- MD5
  
  771bd2e1c6a95d3d1ca532ef231728a4
- SHA1
  
  c453be4365b2f26655c39ab5a539ba165d3f3ca5
- SHA256
  
  294092e9f3e169221b6d7ab142106974b481d253023b9cf43e687ceeba302106
- SHA512
  
  40cb9aa1d25e9a3227bbeca5dedd7fb9b36868568fababc8ea953816a41d113001403915b4c52a1996f28ce3460e958f4627204a0f6ae6091416fd5e94ac6070
- SSDEEP
  
  98304:dKGSyxNgUPQlhBkSkpmuRGrOvbEwhqB347Es+OMlm4paaH10hbcKoKzGrA2XmsrY:kGSyzgUPOvkSkp5RlTEwY347ZjMky6yG
Score

10^/10

silverrat defense_evasion discovery execution trojan
- SilverRat
  SilverRat is trojan written in C#.
  trojan silverrat
- Silverrat family
  silverrat
- Downloads MZ/PE file
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
behavioral3