castlerat

Resubmissions

05/07/2026, 02:28

260705-cx3lfsgw6w10

02/10/2025, 20:13

25/09/2025, 01:44

25/09/2025, 01:37

21/09/2025, 15:10

23/05/2025, 02:40

Sharing

Copy URL Twitter E-mail

General

Target
7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
Size 7.2MB
Sample251002-yzgmnazpz9
SHA256 7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
MD5 58253bef795c914bb2dca89f74ae0aec
SHA1 ab517aa83178957381a9f9317c15901f4ee79cc4
SHA512 49b0d94812f6a0fd710db9e97fd48413b1002371358bfe3fa2b577773d4f7b9f716dc12191f3f1b76d142fa304f7b4e2a2092e3d6a67be01a546debf9ce62eb4
SSDEEP 49152:DCiAb9key/HOSt9/uW2P5asIOd0S0IBRQVvOIQrDMsjP4yIJgieTgueLJ93Ij/hs:DpsZZwbJFeg/3SP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

castlerat

104.225.129.171

Targets

- Target
  7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
- Size 7.2MB
- SHA256 7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42
- MD5 58253bef795c914bb2dca89f74ae0aec
- SHA1 ab517aa83178957381a9f9317c15901f4ee79cc4
- SHA512 49b0d94812f6a0fd710db9e97fd48413b1002371358bfe3fa2b577773d4f7b9f716dc12191f3f1b76d142fa304f7b4e2a2092e3d6a67be01a546debf9ce62eb4
- SSDEEP 49152:DCiAb9key/HOSt9/uW2P5asIOd0S0IBRQVvOIQrDMsjP4yIJgieTgueLJ93Ij/hs:DpsZZwbJFeg/3SP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

tag_150 apt discovery execution castlerat persistence trojan
- CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Castlerat family
  castlerat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Castlerat family

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2