Overview

overview

10

Static

static

10

affb29980b...f6.exe

windows10-2004-x64

10

affb29980b...f6.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6
  • Size 166KB
  • Sample260303-jv7kyshs3b
  • SHA256 affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
desckvb_ratexecutionpersistencerat

Malware Config

Extracted

Family

  • desckvb_rat

C2

  • manikandan83.mysynology.net:7535

Targets

    • Target
      affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6
    • Size 166KB
    • SHA256 affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executiondesckvb_ratpersistencerat

    • DesckVBRat

      DesckVBRat is a RAT written in C#.

      ratdesckvb_rat

    • Desckvb_rat family

      desckvb_rat

    • Detects DesckVBRat Payload

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks