Overview

overview

10

Static

static

3

7e0d097412...42.exe

windows11-21h2-x64

10

Resubmissions

05/07/2026, 02:28

260705-cx3lfsgw6w10

02/10/2025, 20:13

251002-yzgmnazpz910

25/09/2025, 01:44

250925-b556wavzbs10

25/09/2025, 01:37

250925-b1yk8s1kz810

21/09/2025, 15:10

250921-sj6nysytcs10

23/05/2025, 02:40

250523-c6c26agm6w8

Sharing

Copy URL Twitter E-mail

General

  • Target
    7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
  • Size 7.2MB
  • Sample250925-b556wavzbs
  • SHA256 7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
castlerattag_150aptdiscoveryexecutionpersistencetrojan

Malware Config

Extracted

Family

  • castlerat

C2

  • 104.225.129.171

Targets

    • Target
      7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
    • Size 7.2MB
    • SHA256 7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    tag_150aptdiscoveryexecutioncastleratpersistencetrojan

    • CastleRAT

      CastleRAT is a trojan available in both Python and C variants.

      trojancastlerat

    • Castlerat family

      castlerat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks