Overview
overview
10Static
static
10Dangerous ...AT.exe
windows7-x64
10Dangerous ...AT.exe
windows10-2004-x64
10Dangerous ...nd.exe
windows7-x64
3Dangerous ...nd.exe
windows10-2004-x64
3Dangerous ...ox.dll
windows7-x64
1Dangerous ...ox.dll
windows10-2004-x64
1Dangerous ...og.rtf
windows7-x64
4Dangerous ...og.rtf
windows10-2004-x64
1Dangerous ...nd.exe
windows7-x64
3Dangerous ...nd.exe
windows10-2004-x64
3Dangerous ...ub.exe
windows7-x64
6Dangerous ...ub.exe
windows10-2004-x64
7Dangerous ...ub.exe
windows7-x64
3Dangerous ...ub.exe
windows10-2004-x64
3Dangerous ...ub.vbs
windows7-x64
1Dangerous ...ub.vbs
windows10-2004-x64
1Dangerous ...il.dll
windows7-x64
1Dangerous ...il.dll
windows10-2004-x64
1Dangerous ...io.dll
windows7-x64
1Dangerous ...io.dll
windows10-2004-x64
1Dangerous ...AN.exe
windows7-x64
1Dangerous ...AN.exe
windows10-2004-x64
1Dangerous ...df.exe
windows7-x64
3Dangerous ...df.exe
windows10-2004-x64
3Dangerous ...nt.dll
windows7-x64
3Dangerous ...nt.dll
windows10-2004-x64
3Dangerous ...nx.dll
windows7-x64
3Dangerous ...nx.dll
windows10-2004-x64
3Dangerous ...li.dll
windows7-x64
3Dangerous ...li.dll
windows10-2004-x64
3Dangerous ...Dc.dll
windows7-x64
1Dangerous ...Dc.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2025, 15:30
Behavioral task
behavioral1
Sample
Dangerous RAT/Dangerous RAT.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Dangerous RAT/Dangerous RAT.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Dangerous RAT/Extensions/Bind.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Dangerous RAT/Extensions/Bind.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Dangerous RAT/FastColoredTextBox.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Dangerous RAT/FastColoredTextBox.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Dangerous RAT/Kalogar_Online/Dell-12-30-2020/Keylog.rtf
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Dangerous RAT/Kalogar_Online/Dell-12-30-2020/Keylog.rtf
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Dangerous RAT/Kay/Bind.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral10
Sample
Dangerous RAT/Kay/Bind.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Dangerous RAT/Kay/Stub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Dangerous RAT/Kay/Stub.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Dangerous RAT/Kay/Stub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Dangerous RAT/Kay/Stub.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Dangerous RAT/Kay/Stub.vbs
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Dangerous RAT/Kay/Stub.vbs
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Dangerous RAT/Mono.Cecil.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Dangerous RAT/Mono.Cecil.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Dangerous RAT/NAudio.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
Dangerous RAT/NAudio.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Dangerous RAT/Plugin/AN.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral22
Sample
Dangerous RAT/Plugin/AN.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Dangerous RAT/Plugin/Adf.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral24
Sample
Dangerous RAT/Plugin/Adf.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Dangerous RAT/Plugin/Ant.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Dangerous RAT/Plugin/Ant.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Dangerous RAT/Plugin/Anx.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Dangerous RAT/Plugin/Anx.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Dangerous RAT/Plugin/Cli.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Dangerous RAT/Plugin/Cli.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Dangerous RAT/Plugin/Dc.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Dangerous RAT/Plugin/Dc.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
Dangerous RAT/Plugin/AN.exe
-
Size
15KB
-
MD5
b3c721c3314d2c20ba685e6b03601467
-
SHA1
8f1e158e5199394f9687f25e216213ee8172996d
-
SHA256
3120498168f968b2e7a3f44ef09b9c2e99da6b3dd64b1728df20f873297b7431
-
SHA512
7d71934d84a4d99d65ba03c2019632694a1bce76dc0ea95ca52db00070bfc660e66bd288b8d08928767222b74a4232cbc5019eef56952f6a522eb64ef8846eef
-
SSDEEP
384:b0is/P8/d+iU1irbb09VkwqELjwF2pMT0HWSJU36:b0iu81gKbbsxi6
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe 3828 AN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3828 AN.exe