Overview

overview

10

Static

static

10

ColdRAT/ColdRAT.exe

windows10-2004-x64

5

ColdRAT/ColdRAT.exe

windows11-21h2-x64

5

ColdRAT/DotNetZip.dll

windows10-2004-x64

1

ColdRAT/DotNetZip.dll

windows11-21h2-x64

1

ColdRAT/Fa...ox.dll

windows10-2004-x64

1

ColdRAT/Fa...ox.dll

windows11-21h2-x64

1

ColdRAT/Fixer.bat

windows10-2004-x64

1

ColdRAT/Fixer.bat

windows11-21h2-x64

1

ColdRAT/GM...re.dll

windows10-2004-x64

1

ColdRAT/GM...re.dll

windows11-21h2-x64

1

ColdRAT/GM...ms.dll

windows10-2004-x64

1

ColdRAT/GM...ms.dll

windows11-21h2-x64

1

ColdRAT/Guna.UI2.dll

windows10-2004-x64

1

ColdRAT/Guna.UI2.dll

windows11-21h2-x64

1

ColdRAT/Ic...or.dll

windows10-2004-x64

1

ColdRAT/Ic...or.dll

windows11-21h2-x64

1

ColdRAT/NAudio.dll

windows10-2004-x64

1

ColdRAT/NAudio.dll

windows11-21h2-x64

1

ColdRAT/Ne...on.dll

windows10-2004-x64

1

ColdRAT/Ne...on.dll

windows11-21h2-x64

1

ColdRAT/Pl...ws.dll

windows10-2004-x64

1

ColdRAT/Pl...ws.dll

windows11-21h2-x64

1

ColdRAT/Pl...at.dll

windows10-2004-x64

1

ColdRAT/Pl...at.dll

windows11-21h2-x64

1

ColdRAT/Pl...um.dll

windows10-2004-x64

1

ColdRAT/Pl...um.dll

windows11-21h2-x64

1

ColdRAT/Pl...rd.dll

windows10-2004-x64

1

ColdRAT/Pl...rd.dll

windows11-21h2-x64

1

ColdRAT/Pl...ss.dll

windows10-2004-x64

1

ColdRAT/Pl...ss.dll

windows11-21h2-x64

1

ColdRAT/Pl...er.dll

windows10-2004-x64

1

ColdRAT/Pl...er.dll

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ColdRAT.zip

  • Size

    20.0MB

  • Sample

    250419-16qj9ayjw2

  • MD5

    c761941a49b0689482c063e66ec2ba84

  • SHA1

    53c0795b52c9ecc669b6d05aca45933838df85d7

  • SHA256

    8fedd0ca0e90c113950ca9fe3685c46bc51515ff68791ef26eb87dd4da965890

  • SHA512

    b43b95b0fb0486e4be713fee1e7aacf9ab9702ad170f429ff6120d75d741be109bf92a29dae0fbcebe984ba05198feb763de1cadfffd7ff6ebd105b92904ee70

  • SSDEEP

    393216:9lSeO+M2Eyea3KvSNRV7ab5Eed7Bco/8PVKa1T65MNH69+iRBds73:9lScoa3KvO6bxdVc4G565M493sz

Score
10/10
stormkittyexecution

Malware Config

Targets

    • Target

      ColdRAT/ColdRAT.exe

    • Size

      9.5MB

    • MD5

      d1dd11a93098bdea72c1d6743d26ce8d

    • SHA1

      38535678875626a2ee2f32a786e7e671fe19c579

    • SHA256

      22cb65ecad3abf018473b6760958414740a009ead7b968cdc3ac889a38e0427a

    • SHA512

      b1008af59d3df4a9645bd446afdeb77dfc53634b29f56b9fc37d82e90141d243e15468f7e2532859f9702701199fcd140126ef7541e5f65505f645a32a561bfd

    • SSDEEP

      196608:VW6NA/0Lqz6Dc5i2cklYXrE1xTqL1WrJd4KT:YWW0q6A2QTqBgv

    Score
    5/10
    execution

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      ColdRAT/DotNetZip.dll

    • Size

      461KB

    • MD5

      a999d7f3807564cc816c16f862a60bbe

    • SHA1

      1ee724daaf70c6b0083bf589674b6f6d8427544f

    • SHA256

      8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

    • SHA512

      6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

    • SSDEEP

      6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW

    Score
    1/10
    behavioral3behavioral4

    • Target

      ColdRAT/FastColoredTextBox.dll

    • Size

      323KB

    • MD5

      93b19f24add82a6cda96bbb3eaa755f9

    • SHA1

      b83179a79862aedc92ee79b6cb8a7e4525266687

    • SHA256

      6eb6a0c64ee8c575f56a93065138b17883118cf231a6916fc601ec86793d85bf

    • SHA512

      2521a11cc557b68b05f57048d1f2bb719fcac86c19e151bc16d3938d45f9c7ece72a5573d3293b0c290cb7f141c0dc3a1aa422444997473697836ec4a112a8f6

    • SSDEEP

      6144:5creWpl5UDYd01MVwKaWVwu1h3eE3L/CdesqtLDI5eNBAkM:5eJyDgaKlrh3bb/I3eNOk

    Score
    1/10
    behavioral5behavioral6

    • Target

      ColdRAT/Fixer.bat

    • Size

      122B

    • MD5

      2dabc46ce85aaff29f22cd74ec074f86

    • SHA1

      208ae3e48d67b94cc8be7bbfd9341d373fa8a730

    • SHA256

      a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

    • SHA512

      6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

    Score
    1/10
    behavioral7behavioral8

    • Target

      ColdRAT/GMap.NET.Core.dll

    • Size

      2.9MB

    • MD5

      819352ea9e832d24fc4cebb2757a462b

    • SHA1

      aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

    • SHA256

      58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

    • SHA512

      6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

    • SSDEEP

      49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh

    Score
    1/10
    behavioral10behavioral9

    • Target

      ColdRAT/GMap.NET.WindowsForms.dll

    • Size

      147KB

    • MD5

      32a8742009ffdfd68b46fe8fd4794386

    • SHA1

      de18190d77ae094b03d357abfa4a465058cd54e3

    • SHA256

      741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

    • SHA512

      22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

    • SSDEEP

      3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ

    Score
    1/10
    behavioral11behavioral12

    • Target

      ColdRAT/Guna.UI2.dll

    • Size

      1.9MB

    • MD5

      bcc0fe2b28edd2da651388f84599059b

    • SHA1

      44d7756708aafa08730ca9dbdc01091790940a4f

    • SHA256

      c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

    • SHA512

      3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

    • SSDEEP

      24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw

    Score
    1/10
    behavioral13behavioral14

    • Target

      ColdRAT/IconExtractor.dll

    • Size

      10KB

    • MD5

      640d8ffa779c6dd5252a262e440c66c0

    • SHA1

      3252d8a70a18d5d4e0cc84791d587dd12a394c2a

    • SHA256

      440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

    • SHA512

      e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

    • SSDEEP

      192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

    Score
    1/10
    behavioral15behavioral16

    • Target

      ColdRAT/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    1/10
    behavioral17behavioral18

    • Target

      ColdRAT/Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    behavioral19behavioral20

    • Target

      ColdRAT/Plugins/ActiveWindows.dll

    • Size

      14KB

    • MD5

      5a766a4991515011983ceddf7714b70b

    • SHA1

      4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

    • SHA256

      567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

    • SHA512

      4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

    • SSDEEP

      384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7

    Score
    1/10
    behavioral21behavioral22

    • Target

      ColdRAT/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      59f75c7ffaccf9878a9d39e224a65adf

    • SHA1

      46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

    • SHA256

      aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

    • SHA512

      80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

    • SSDEEP

      384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe

    Score
    1/10
    behavioral23behavioral24

    • Target

      ColdRAT/Plugins/Chromium.dll

    • Size

      32KB

    • MD5

      edb2f0d0eb08dcd78b3ddf87a847de01

    • SHA1

      cc23d101f917cad3664f8c1fa0788a89e03a669c

    • SHA256

      b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

    • SHA512

      8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

    • SSDEEP

      768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa

    Score
    1/10
    behavioral25behavioral26

    • Target

      ColdRAT/Plugins/Clipboard.dll

    • Size

      14KB

    • MD5

      831eb0de839fc13de0abab64fe1e06e7

    • SHA1

      53aad63a8b6fc9e35c814c55be9992abc92a1b54

    • SHA256

      e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

    • SHA512

      2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

    • SSDEEP

      192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU

    Score
    1/10
    behavioral27behavioral28

    • Target

      ColdRAT/Plugins/Cmstp-Bypass.dll

    • Size

      11KB

    • MD5

      cf15259e22b58a0dfd1156ab71cbd690

    • SHA1

      3614f4e469d28d6e65471099e2d45c8e28a7a49e

    • SHA256

      fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

    • SHA512

      7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

    • SSDEEP

      192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ

    Score
    1/10
    behavioral29behavioral30

    • Target

      ColdRAT/Plugins/FileManager.dll

    • Size

      679KB

    • MD5

      641a8b61cb468359b1346a0891d65b59

    • SHA1

      2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

    • SHA256

      b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

    • SHA512

      042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

    • SSDEEP

      12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

stormkitty
Score
10/10

behavioral1

execution
Score
5/10

behavioral2

execution
Score
5/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10