octorat | a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13[.]zip

General

Target
a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.zip
Size 148KB
Sample260312-f76mmsgw8x
SHA256 afdde7c94ab77452bec33e8823465f3bd7b252f7f22ee7bd4826bf634ffef1e6
MD5 cce0e85e4dd4a63bec35899868659618
SHA1 035f81f31f5f2c2fd30ea26f2ed6195fa1fdbf31
SHA512 c4ed4b2593069dcb76d886c9bf07ed04a59d9da8287da308d54b03880cd015ab25e73dc6666fc1e8ff49eb8e700b00170f5818e7a6c979eda3f77b6544942186
SSDEEP 3072:vpZowFrohUnj76xrToMG1fYWtvLnQ7yDwal3bsTgtP52WGJ/1dzwiL0/N5:dIUnMd4fYWFnQ7yZAToMZJ3zwOo
TLSH
T172E313A69BAB517F130824D3EFD379B53C94CED238391D5FE5F26824A21345B0C4896C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

octorat

Malware Config

Signatures

Detects OctoRAT 1 IoCs

resource	yara_rule
static1/unpack001/a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe	family_octorat

Octorat family
octorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe

File Explorer

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.zip

.zip 148KB
a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe

.exe 411KB

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.zip

SHA256 afdde7c94ab77452bec33e8823465f3bd7b252f7f22ee7bd4826bf634ffef1e6
MD5 cce0e85e4dd4a63bec35899868659618
SHA1 035f81f31f5f2c2fd30ea26f2ed6195fa1fdbf31
SHA512 c4ed4b2593069dcb76d886c9bf07ed04a59d9da8287da308d54b03880cd015ab25e73dc6666fc1e8ff49eb8e700b00170f5818e7a6c979eda3f77b6544942186
SSDEEP 3072:vpZowFrohUnj76xrToMG1fYWtvLnQ7yDwal3bsTgtP52WGJ/1dzwiL0/N5:dIUnMd4fYWFnQ7yZAToMZJ3zwOo
TLSH
T172E313A69BAB517F130824D3EFD379B53C94CED238391D5FE5F26824A21345B0C4896C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13
MD5 edf42f83998f7ab9ae13b6a5836a46b3
SHA1 d96f07908ff11e57bd94b959c0dffc6590aee25a
SHA512 804e01668e7cccd7c4a3a1c51b070a36998f222b2fc861fecfc337b0a1f369a1069826f672e85bbc84605f38e488659a302744edcab3117fa0038574e5ca4f74
SSDEEP 6144:VPJiQz7AGn4oXNJA91sL59j17WimTvpqBZi4PjAuMofwa50qHY9bHLMgdMN5A:2QzLnXA9qLJ7WFm/jT50ty5A
TLSH
T1DA94D69067F94604F2FF2F79A9B245114A76BC93AC35D34E098694DE0EB3B81DC21B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects OctoRAT
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

425630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sulum\OneDrive\Desktop\server\server\stubCsharp\obj\Release\Client.pdb

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.zip

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.zip

a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13.exe

mscoree

dotnet