888rat | 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c

General

Target
888_RAT.exe
Size 22.0MB
Sample260418-nn71csgw5l
SHA256 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c
MD5 54c6dc01ba6c748106085665ff8ad61b
SHA1 f75d970df21d277d39656aeff50752d415b47c6e
SHA512 9b5498b40de25dc788a728979518e3b6edcc1f0a0444f96bb19c68f91036b552b248d78b5f783ee5247eb7f7bb1272b4e4edf3f2c6650674c16b72593eec7f8d
SSDEEP 393216:AP1PWZEdKBGwPLApMDvm9YL8mp3YsxXUSqqEDPqwTOfxUbEe2pjEgSl7ltlx:qUAKZLEym923Ysx2qeoS1mjr4Pf
TLSH
T1E937338283B95CB4CDC6377B028ADFB799749C925C626DE686C32E172F9EE411D187C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  888_RAT.exe
- Size 22.0MB
- SHA256 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c
- MD5 54c6dc01ba6c748106085665ff8ad61b
- SHA1 f75d970df21d277d39656aeff50752d415b47c6e
- SHA512 9b5498b40de25dc788a728979518e3b6edcc1f0a0444f96bb19c68f91036b552b248d78b5f783ee5247eb7f7bb1272b4e4edf3f2c6650674c16b72593eec7f8d
- SSDEEP 393216:AP1PWZEdKBGwPLApMDvm9YL8mp3YsxXUSqqEDPqwTOfxUbEe2pjEgSl7ltlx:qUAKZLEym923Ysx2qeoS1mjr4Pf
- TLSH
  T1E937338283B95CB4CDC6377B028ADFB799749C925C626DE686C32E172F9EE411D187C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution installer persistence privilege_escalation trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  888_RAT_1.0.9 Cracked by Shark M!nd.exe
- Size 22.0MB
- SHA256 beb837e8832f27dacfd3719cf617310f1b9e74badbfca8705ecafce3ed5e6a33
- MD5 32004e656640aad1672f0ee98434bc3c
- SHA1 d665b4e03e9d75f87079d65cff791147b7ee6e4f
- SHA512 1cd55008d6352469a937f168d6d72cfd202d81c24a6be4c6256a4c73c576577aefe8da912c5cb09e12f12a58e46f99381fa9834b58bc356e0c530908b236785f
- SSDEEP 393216:TufwMCigvYFChWbRT5OV7lAUl+9o0okMLeDuq3+QAk5ubWWBwBvJ5wV:aXZgvYYhQDOVPl+9l2+OZuhQwR/
- TLSH
  T149373302A3A9D031FFDBA3336B69FB155A7C7C210823896F13891D3A7D755611A3C7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery 888rat infostealer rat trojan upx
- Android 888 RAT payload
- Family: 888RAT
  888RAT is an Android remote administration tool.
  trojan infostealer rat 888rat
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  majid z hacker website.exe
- Size 417KB
- SHA256 34ddd8dafe9e6fabe4cac3428ce0f9b1d51183ecd3d70aa4d483086ee64a514f
- MD5 24995d61ddcd09aca3877ee88552d57c
- SHA1 cf3bba8be96058daff0eba22c3e17510fabd458d
- SHA512 3de2434f9c75634921165daec270ffc6c4d9c14ff89328213f245d1b042ed4329b1817001c3eb27cd586bd86c2513585b9b516d2322c92e7b6f74a40e3b3d7c7
- SSDEEP 12288:6b81qE0efXk6XLUwx7YfR43dZtW8U7oxH:6L5yU6XIGYqdDW8z
- TLSH
  T1689402497F018EA3CAC201B91396EBB2E1A7DC0443B3527743E53E677E3EA8725256C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  microsoft corporation.exe
- Size 33KB
- SHA256 58c8e3599d16762dfc51decf16c3d014cd8c8dd1aab59a0acff5372c5182bda7
- MD5 23fb3146d1455b890afdbd9511b48351
- SHA1 9e0118366167c76de2d88fb354606d5e58677eb7
- SHA512 92a816b16f854cb19a28a9bd186223dd3f7961800b6486b32be1f270b26a0240c0f68ebe0f6c555b72f0e3388f3aa1a061fad50c0b09aaec1af9de1185fc8cf4
- SSDEEP 768:AZpwhb5dwhZTRBwdVwI8PBw3ccrfLAkr:A8uzNiwtBw3cafUkr
- TLSH
  T199E2184C73648923C6BE47B89D70864647F1D14B5512EFAF8EC460EA1EA7BE41E00EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral4
- Target
  program startup.exe
- Size 356KB
- SHA256 ddfaaf02cbb33b9bbc9117dcdea0da555f4a6bf1d852e7e121bf9930cc2e4404
- MD5 4caacd7358ca6be0197a8d7dd73f1347
- SHA1 b0a0c0f64cfb9db363e423f1f2a72312c7d551fb
- SHA512 84b19e735896baa67d996e91a7144092944147eb6949d887308519699ceec481f0ed16c766103ba62e90a679c397bb0f0e0ec7f45fab554d89cc54f373fd801f
- SSDEEP 6144:nuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLTqCum9Y3BPK7z:u6Wq4aaE6KwyF5L0Y2D1PqL29XU7z
- TLSH
  T12C7423EBB7617700F8F803B6E2C70152C1A0B5A197BD8F7DB5082667B4AF1017DAAB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence upx
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  script.vbs
- Size 1KB
- SHA256 ecd586281fc4655e40108fcf118beeae3411c1c1176951a763e47fb66d2e421f
- MD5 77a4da4863ffcaba51ce05d3c632158d
- SHA1 253f9a594a6ca3a7a23acb90f8dc81939215ba4b
- SHA512 ba215fa65a011f5841f5e92b4053895c13368e894817551a982ca3e821726b8bbb13616bca8781fed08f4c83528d0d3ac233fa1f3e14ad4253fdefd9a22253cf
- TLSH
  T14C41F201E6695D561777A29232A37F4F13BE081672AB4C31E00D8CAD4793F9F077B951
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion evasion execution trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral6