Borat.rar
- SHA256 3f8903be3b24c4a2f8ce493acbf1acb682f4fc6ec2f94f9c4bb73e1c8876401f
-
Detects BoratRAT RAT
Behavioral task
behavioral1
Sample
Borat/raw/Client.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Borat.rar
- Size 9.6MB
- Sample260513-j9kpqsbs8q
- SHA256 3f8903be3b24c4a2f8ce493acbf1acb682f4fc6ec2f94f9c4bb73e1c8876401f
- MD5 7eca692b1f09d8108352d2b228832666
- SHA1 000883d4875312858afcf8dc19ee833fca29eee9
- SHA512 43262c2d5853fb84be24007000b9aca162f92f643e3e7b4d31582a5183b09e9733d47183b7dc69310e419116f651a4d906af10ca9084c0ca8ab0200185eec4e9
- SSDEEP 196608:yYiaTYbJGuvLH8J2CYy1tWIaeyREdW8jR230A8QoZAUAzvypQ:gaqIuAJ2C3/7yV8q0AX+AlzKS
- TLSH T1D0A633E999F9E531A9B39BD242C0B5B53B6F529008534D022D08F295B9C676C8CE3D3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects BoratRAT RAT 2 IoCs
resource yara_rule sample family_boratrat static1/unpack001/Borat/BoratRat.exe family_boratrat_net - Unsigned PE 24 IoCs
Checks for missing Authenticode signature.
resource unpack001/Borat/BoratRat.exe unpack001/Borat/bin/Audio.dll unpack001/Borat/bin/Discord.dll unpack001/Borat/bin/Extra.dll unpack001/Borat/bin/FileManager.dll unpack001/Borat/bin/FileSearcher.dll unpack001/Borat/bin/Fun.dll unpack001/Borat/bin/Information.dll unpack001/Borat/bin/Keylogger.exe unpack001/Borat/bin/Logger.dll unpack001/Borat/bin/MessagePackLib.dll unpack001/Borat/bin/Miscellaneous.dll unpack001/Borat/bin/Netstat.dll unpack001/Borat/bin/Options.dll unpack001/Borat/bin/ProcessManager.dll unpack001/Borat/bin/Ransomware.dll unpack001/Borat/bin/Recovery.dll unpack001/Borat/bin/Regedit.dll unpack001/Borat/bin/RemoteCamera.dll unpack001/Borat/bin/RemoteDesktop.dll unpack001/Borat/bin/ReverseProxy.dll unpack001/Borat/bin/SendFile.dll unpack001/Borat/bin/SendMemory.dll unpack001/Borat/raw/Client.exe
File Explorer
-
Borat.rar.rar 9.6MB
-
Borat/BackupCertificate.zip.zip 1KB
-
ServerCertificate.p121KB
-
Borat/BoratRat.exe.exe 20.0MB
-
Borat/BoratRat.exe.config.xml 5KB
-
Borat/ServerCertificate.p121KB
-
Borat/bin/Audio.dll.dll 23KB
-
Borat/bin/Discord.dll.dll 24KB
-
Borat/bin/Extra.dll.dll .ps1 31KB
-
Borat/bin/FileManager.dll.dll 32KB
-
Borat/bin/FileSearcher.dll.dll 277KB
-
Borat/bin/Fun.dll.dll 33KB
-
Borat/bin/Information.dll.dll 24KB
-
Borat/bin/Keylogger.exe.exe 10KB
-
Borat/bin/Logger.dll.dll 26KB
-
Borat/bin/MessagePackLib.dll.dll 16KB
-
Borat/bin/Miscellaneous.dll.dll 82KB
-
Borat/bin/Netstat.dll.dll 24KB
-
Borat/bin/Options.dll.dll 378KB
-
Borat/bin/ProcessManager.dll.dll 25KB
-
Borat/bin/Ransomware.dll.dll 97KB
-
Borat/bin/Recovery.dll.dll 1.3MB
-
Borat/bin/Regedit.dll.dll 279KB
-
Borat/bin/RemoteCamera.dll.dll 107KB
-
Borat/bin/RemoteDesktop.dll.dll 34KB
-
Borat/bin/ReverseProxy.dll.dll 14KB
-
Borat/bin/SendFile.dll.dll 26KB
-
Borat/bin/SendMemory.dll.dll 27KB
-
Borat/bin/ip2region.db8.9MB
-
Borat/raw/Client.exe.exe 56KB
Borat/BackupCertificate.zip
- SHA256 f13033134c386e85a1e9009e863a3e6380438f83e3336b76a33e701a88f64946
- MD5 9322f71edd95192e1f4d275bfd6d87f3
- SHA1 41abf39c714cf42de8ad919cd2b180df3975c124
- SHA512 99a55e9a582367faedfe9d38992c7139b7753125b42d511081af688a17bd86be8dc0b774349d446e72ae47f3477559b94873022388166fc99bf5eda4e5fe9e6b
- TLSH T123415D8194C10AA8C1B340754F31C167764DB4D103021E9C61BD7B61C5CB0DADD1FF75
- MD5 SHA1 SHA512 TLSH
-
Detects BoratRAT RAT
ServerCertificate.p12
- SHA256 4b0612b2cd5e7ecc456d5c29c89917b8ec881c5f4fd94afe157098ca96308781
- MD5 478ee44a47895e687296b9ab34df04c4
- SHA1 4b81e94f3d3a99cc01d5c57bd5bec8317f0aca4f
- SHA512 28c0635f1e5062fcdef783aceaa8aa53531f18ce66d4aed62a99ec5b31a364e0d0d36fa237d978d75f51a859a7140d31e62aed340eae4aa769e02d1640e30c7b
- TLSH T1C731D727AC6B2A797D3ECE886CB48D974624EB4017B02A6FE96914780C20641D19CD5E
- MD5 SHA1 SHA512 TLSH
-
Detects BoratRAT RAT
Borat/BoratRat.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 de60ecbbfef30c93fe8875ef69b358b20076d1f969fc3d21ab44d59dc9ef7cab
- MD5 65b694d69d327efe28fcbce125401e96
- SHA1 049d4d71742b99a598c074458f1f2d5b0119e912
- SHA512 7ab57642e414e134e851d9aa2ed3ef8b483f3a5f77877cdc04e08d7f95c44884f8ccc6beaf8ba7f6949cfd7398c46be46c024d4fdeacd3a332d4565609baad5b
- SSDEEP 393216:V+G+oTCP+Zw6NLIsFfskh1BmXGnfBd+Uw:IGpTCP+Zlnk0rmkBYUw
- TLSH T1E227C001FAE4CA56D07A9AF5D0B306759BB0AD19E72287BB1180BB5D3EF37447812327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20915742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
19.9MB
Virtual Size
19.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/BoratRat.exe.config
- SHA256 f29e697efd7c5ecb928c0310ea832325bf6518786c8e1585e1b85cdc8701602f
- MD5 3e645ccca1c44a00210924a3b0780955
- SHA1 5d8e8115489ac505c1d10fdd64e494e512dba793
- SHA512 ea7e3a6e476345870f05124a56dde266e1ad04b557b2dde83c5674cfdf3be00f26d3db6a14a8d88ecf75e2c9e3a12e6955f6c85654ba967c17664e9acc3d4f1f
- SSDEEP 96:Xr7T7Kc7KnreNRrqAbGxRN3ZV/Kw4YpyMasJ8J4YqJyM/:Xr7T7D7or8E3ZV/Kw/pvasJ8J/qJv/
- TLSH T127B1E758B1F5CEAA014A2A32EB305285DEE006631275B4F8B8FD21555F51CCB8BB37F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
Borat/ServerCertificate.p12
- SHA256 4b0612b2cd5e7ecc456d5c29c89917b8ec881c5f4fd94afe157098ca96308781
- MD5 478ee44a47895e687296b9ab34df04c4
- SHA1 4b81e94f3d3a99cc01d5c57bd5bec8317f0aca4f
- SHA512 28c0635f1e5062fcdef783aceaa8aa53531f18ce66d4aed62a99ec5b31a364e0d0d36fa237d978d75f51a859a7140d31e62aed340eae4aa769e02d1640e30c7b
- TLSH T1C731D727AC6B2A797D3ECE886CB48D974624EB4017B02A6FE96914780C20641D19CD5E
- MD5 SHA1 SHA512 TLSH
-
Detects BoratRAT RAT
Borat/bin/Audio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 df31a70ceb0c481646eeaf94189242200fafd3df92f8b3ec97c0d0670f0e2259
- MD5 9726d7fe49c8ba43845ad8e5e2802bb8
- SHA1 8bcdf790826a2ac7adfc1e8b214e8de43e086b97
- SHA512 f97bc1e2ecbbc979d0eea3559c2da0982e4617eb217603224263ef825b8d98b3c52392eeef41888e6295fb60d362f9521e2f2bdaccc762c4591565f9e6248658
- SSDEEP 384:cSRj1EfmW3sHmH+6kBdseXGDfICDzu5RQ0juAa04FOkhcV:cSRj1N0sHieK/7CuAhROw
- TLSH T11AB21A02BFA8D7B3DB9C077854B353502775D1A66802FF875E9840F69E137CA1A227CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Discord.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8fa7634b7dca1a451cf8940429be6ad2440821ed04d5d70b6e727e5968e0b5f6
- MD5 7ee673594bbb20f65448aab05f1361d0
- SHA1 2a29736882439ef4c9088913e7905c0408cb2443
- SHA512 f5d8457279a5c0684c075eae2d3de62b672303520a1c725b4f97787961e6043c73ca68d4353e5d4168a427104be65b74a9c92a87419348e92d772368e94fab7c
- SSDEEP 384:d0FmIXW/ppmaCnN594J+Im/tvp2BdseXGcdh+JaL6EWAVuk5mSZ7rN2TD118Ksuz:sECaC7iGqQ0jNZ5mSZZWDEKsK
- TLSH T14CB21802AB549773DBAD47BD457313148378E2A6A903EB5A2ED860F21C133CE4F61AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Discord.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a4f32b0228092ce68e8448c6f4b74b4c654f40fb2d462c1d6bbd4b4ef09053d
- MD5 62c231bafa469ab04f090fcb4475d360
- SHA1 82dda56bc59ac7db05eddbe4bcf0fe9323e32073
- SHA512 515fbdc9e792bd7ab711261c1d0185351079a2d5b104211c559cfc4c8465794ef897c43f0f825b4fc2e97a56525f73c3ad0a28de0fcf8b8bff89c26d1c97b3cc
- SSDEEP 384:UX8AFmmb7f0BOheE6qCt57udseXG8WIThDkz7R3bu4Uwvs7c9K7ZvTbJlXKyckew:E8Avb7fwCk1uLRkVsA9K7Zv76keFBFu
- TLSH T156E23A062F6CDA37DEAD477598B307184376D65B7803FB0A6CD420B86E83BEB46116C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Extra.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f8a306826fcb0ee985a2b6d874c805f7f9b2062a1123ea4bb7f1eba90fc1b81
- MD5 4ccd3dfb14ffdddfa598d1096f0190ea
- SHA1 c68c30355599461aca7205a7cbdb3bb1830d59c8
- SHA512 2fa3ea13054d84e1a307ddc63f2a364c760b8e1882fee975585e6e1bae41cad3463495d22d0c8fb77d40e6b0336c3537ab68efb5fd84e46063a336ba20672cbc
- SSDEEP 384:GEGHWHugXvIgTmm49cj7ddseXGMBNhD8mouIXA4Pcg4lYzMnIqE7GMiBrNelgPU:Gb2fN49ydxZyXMXLnIr7GMarNc
- TLSH T10DE21B00BFA89263D35E877968F3431802F5E46F6503DB4B8CD820F66B237EA5A45DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d9625f41793f62bfe32c10b2d5e05668e321bcaf8b73414b3c31ef677b9bff4
- MD5 0b7c33c5739903ba4f4b78c446773528
- SHA1 b58555bebddf8e695880014d34a863a647da547e
- SHA512 d3ea78dcc15e5f365df55558b911f3289f516ecb16c07b7132084ec2e3b10f496d1ef0774416775c14caffbf3107220cfc19ec910cdb2637561b12a23fd1e43f
- SSDEEP 3072:EGFYQ/KZdG6oE1nKSYfTvqCjUKidQTs2pccc9k1DEIWcSCSLeyYcEeI/KQ73WmbN:EnwLrSYfDjtlAx9k1An4pE0
- TLSH T1AB544B406BE9CA57F1BF27B6C0F3525187B8E152A57EEB8F4C8014EE1917340DA217AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
289942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dcac599b1bab37e1a388ac469e6cc5de1f35eb02beaa6778f07a1c090ce3ea04
- MD5 499fc6ac30b3b342833c79523be4a60c
- SHA1 dcf1ed3fbc56d63b42c88ede88f9cad1d509e7ec
- SHA512 b63dcf0f42a4e80747556000aeee72137735cb7177567df6cfef3f15471efb8c4dc797db8cdc870d66cd87f09ffc7ab177969b126825a69e4b5390b568462484
- SSDEEP 768:DOFmXPm7MACQnB5vrTh+g0R2Lybx9gnn:DOFNnB5XJL8e
- TLSH T1BEF22A08EBA5D677EB5C0738E4B353148375D4E36402EF8A0CD820E66A477CA4F65BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Information.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a15d72d990686d06d89d7e11df2b16bcd5719a40298c19d046fa22c40d56af44
- MD5 87651b12453131dafd3e91f60d8aef5a
- SHA1 d5db880256bffa098718894edf684ea0dc4c335d
- SHA512 1b911a877c5a3f508421f4f250d95861a5c110cb4b67ffe05de157085c5a018d34d9574c1ef4cf9eec3ba3cdd39985863564ea2f77814812032ea796cb329afa
- SSDEEP 384:zsvmkKbpmUGZdseXGvXhDYLuqInXx3McZ+RaYzwM3tllsXxMSDv:w+kKb0bZIqInpXZ+RtzAxMSj
- TLSH T139B20B01FBA8C763D7AD1B7957B303084BB5F5E59822EB4E5D5010B6192B7CA8E213D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 16beb1ae2de2974ccc2371d9f619f492295e590abb65d3102e362c8ec27f2bbb
- MD5 a45679bdcf30f068032bd37a194fa175
- SHA1 f23fd98f28bb0b482f0aae028172e11536e4688c
- SHA512 3b6a954de9ec3b82719af8c3fd3de2137096b182990363abc8a68e20c1d1d419fc594a7955759a64de3582a92662315a3ead8193c2806efcff113dc2c61c4518
- SSDEEP 192:mStmcuq6QIDxi4maEYbRzmEsLkugv5JHTeeJYHcwY7fazItxEEi:mStlF6QmE9rUhVsLe5perYyAEE
- TLSH T17C220981BBE88775DD7927B698F747501570E2055C73C9AF1898111E3EA72410FC3BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Logger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f258949fd95da6cd912beb7203a9fd5e99d050309a40341de67537edb75aadc
- MD5 872145b37d107144894c9aa8729bad42
- SHA1 01610587bcfa7ac379b1f0169a2a9ab384b9116b
- SHA512 0c926d24515b8ea80586c80d2613136f802badde3a788d2960ebd8f6a4d6e901d1ea220262f3d2a852c4f3da88bd69915070de920bc79eb82329c44dcab98435
- SSDEEP 384:ny2nOVC1a1WmAcsH2Co9KPdseXG8iIhDbuLCG4kNmXWuxb87AMFah:nrQ1hNsnPZ1Jk6875O
- TLSH T1FEC219057F54D7B7CBAC1BB898A7530543B1C29B2C13EB871C9460F64A537DB0B16ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Logger.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/MessagePackLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 adb00dee751b4ba620d3b0e002f5b6d8b89cf63b062f74ec65bba72294d553d1
- MD5 590b00c87d5ff2ffe09079f0406eb2cd
- SHA1 92c91f1db8c2c8cc34c2e1a26f4f970f1518a7ed
- SHA512 9396620bb9d77cacd7bc2bfa44e8fb76091e314298434d8ba995595df0b2a13edf8229c465b563aa668702176ccf2de34e9fd3d1567d4ff20d94672aba4ad745
- SSDEEP 384:omnkO72iseXGr8puUUqmMDRVE7PuFRQ5:7nkprnJMDRVE72I
- TLSH T1AB72C706AF599623DA6D07BD94A303045735ADA1A403FB9F4C58A1F25E233CF1B727CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f91973113fd01465999ce317f3e7a89df8c91a5efadcfa61e5ccce687bf3580a
- MD5 509d41da4a688a2e50fc8e3afca074c7
- SHA1 228de17938071733585842c59ffb99177831b558
- SHA512 86f975c75e246100d0486aa1507f5c2030323649ae921af51583c6b287e6780e9a9bf887ef4ead11599742cdeb7c90380c7d4859340e11913c2c1f42fb34ef8e
- SSDEEP 1536:+Zce38lSJ3k45otUV251nos3O4Raam/an:+ZceRU4KSV213O4Raat
- TLSH T1CF836D156BA8D927D8BE1BFA34B3061853F1D551B213EB6B9C8414EA1E137D20A237CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7eed1b90946a6db1fe978d177a80542b5db0bf3156c979dc8a8869a94811bf4b
- MD5 12911f5654d6346fe99ef91e90849c13
- SHA1 1b8e63d03feb84d995c02dcbb74da7edfaa8c763
- SHA512 588971ef7aebae7afffb22bafdf8f8bb04bf3c474eabf6637543fe42e3e1800cc824929d953055a4f666776ea5fffe0389ef6216c1dca437e0c8a330f6670c19
- SSDEEP 384:crl+bbgmsHmxSRmqe5HPwKRsJGAdseXGOhBReDmYuFCJG0BBR93NNRk+rs25x55/:cwbWGcMqc45L6eC1B79Tk+gn8sO
- TLSH T109B2F905AB68D777DF5C077DA8F3030903B8D2A66512FB8A5CD830F61B067EA07656CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9b8e795c5a024f9e3c85ba64534b9bf52cc8c3d29b95ff6417dc3a54bc68b95
- MD5 3a474b8dee059562b31887197d94f382
- SHA1 b31455f9583b89cac9f655c136801673fb7b4b9a
- SHA512 cdda908adb88603302b33c99befed0394f12cc34c5a31bc7b4b614df3615ea8a6cad7ef84e7b9865342f33783006974027e39fd458e5936dec14c8ae5e98bf0a
- SSDEEP 6144:DTG2nhDLZ03+biuOd1jScGHkl6GfIrOzXevKvhzmYVV7+FWWz06v:/nnzEYcVXevWBVqO
- TLSH T1DE844C11DFE4C237E9BE17B5E8B3024147B5E48BE566EB4F988864D81C63304AD127BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
393374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
376KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b1f80ff787bdcd7ee12aa64be1f2f5f1f658bd644bbc5fd73527b51da6ce0d6
- MD5 91edcb945924df5fbf4ff123aa63199c
- SHA1 d124869aaee9aa1a49def714774b834335aa746e
- SHA512 6927c1576a8a9ff724fe3b7d53067f97c121b272c1f2528cb8aa1806de61f36504ee4d25d56eb717a1010a80fb6b5e37c1a0c30b256fdb9a5ba5b31794146c52
- SSDEEP 384:IiL3RGwNe7Nm1T33T9OZNA8SwCguRvsPzHdseXGii6ZDWl9UZ5QDBfqFuGvAzx/B:IiL3A2eg1L3B7wUvsPT9mGvixVX
- TLSH T12CB24B056F88E777EABC077AA863531447B1D1B6B402EB8B9DD824F22B077C90A117D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54f554b9e330476b3903756f62b577bab35cdef941d3d0f6a3d607862762bf91
- MD5 ef998529d037fcdb2bde6d046f99db45
- SHA1 1a38a1182155429ecc64c20ece46ec0836c32ec7
- SHA512 4e4376c182dcdf993c6e8f55388829b9e7057e8d80be268a8469721e8ac7fc29eab65681f0f7f2c0dbad1c5bc30fdcc123774ae543770090bf01a62a0d161ece
- SSDEEP 1536:hQaxD6uxxNV41T56kDgJp+isYOmvZfi3OqL4FrQ1vbVa:Kax2uxxNV41T5lkjvv83OqLKU1Za
- TLSH T1DBA3FA152FC486ABCAFD56FE7DA542180BF0D2D6B002FF47494864662CD33A3896D68F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Ransomware.pdb
mscoree
_CorDllMain
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec768f980b651a2fbbbcffb715bcac5214730c02ff21a1a987d6db9cb04f01e1
- MD5 b4762c63cc383eb02cb093eeb88aecf1
- SHA1 a3a1fdd8612c63f6d62d5a62915966be8e922ba1
- SHA512 51a9a8665be79a043dafe114d577988d5ab74803ab738d4d7129136372c7e1db4719c83e98c6e3aa7a8374a84cca570b34274d6bf18272906e6504872c514a1e
- SSDEEP 24576:obiHpeKuuOcI8FeZ1H9StDW+gmGIX4exF9JdjT:obiHAG9cgymGIX4eBj
- TLSH T11B5549047BE4DA27D1EF6776D8F2065047B8E486E3B2E78F569496A92C13340AC443BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1328838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\28718\Documents\GitHub\DcRat\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 657e3f1f449c0b710b0c571ec8eee689ae16793fb63b996e0182420d768f89bd
- MD5 8749c78b8ad09a3b240dd1384a17539b
- SHA1 b9263ac725ccd8c664ae0f9da5fc0d00adcb8c5e
- SHA512 5a910be70c79dec36d3e5c171ba5029612ee2960b8529ffb81d581ab0f20cbc30e6093b838ce1ebc2fab9ed9bbce8ab5f995487852bcba17df4b3480f91aa81b
- SSDEEP 3072:WzAqsjXBXBqf6ura3Rx7+HHgmUK/UI0GWF2gboRW5d5HeuoXxwoMffbRFC:EuRRtL2HgmUGs2ZW5HR6woMfD
- TLSH T1EA542B006FECC717EABE23F5D87915088BF5F51AF61AE74A58A420F90C127846A117BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
291946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
277KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 203300be75ad8f57972324519b2583a44e759cdd57390d6765df10288e249789
- MD5 acbf0f8b09320f3e967ee83fcda26f5d
- SHA1 bbee0fa1c88edcd0469974223fb026e1176256dc
- SHA512 36a9c2810b8b86aa35cb2c18730fdd6b8547a5b9b937f0ffcaaffa5bc17566315d918e68974470ec07c3ca6f841c8d408784f3b6c3d621759edf4e4e8496d75d
- SSDEEP 3072:mOFFLLddftQGkkeeMMyDRRHHZZzmf7oQTLuxkyqIpQkosabuYmBBvU83p+d9:/FFLLddfBkkeeMMyDRRHHZZzq/IpQko8
- TLSH T161B349416B7CD667D79E17F9A0B357008BB1C212A217F3CA1EA814ED6D633805E127EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc5b49d2a2821d4f6ef6af8a1e50994c6690d6a4daa41bd048fe79bd8b578988
- MD5 0f93650dd78557f41b7c5467e3b6b6a7
- SHA1 382bd4496eb7439fde85832abca87cc21cb7872f
- SHA512 15d0b95865316d09e9404a2507bb983a9d9e762e88d749ea61ba1ce15a229ea9d86ba09a7e6319d7bab859986f51eca6792bd42fc18fc1ac11d35b173a9d5fc6
- SSDEEP 768:RgkUHv6PH412Z9z9kqTbwXT/PP1ne1e74F:RnbZXXTUj/PP1ne1q6
- TLSH T1B0F21948AB58D737E69C077AB4A353944379D0DB2503DF472D9084EA2A137CF0EA53DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d8a115310142f2e874dc7ea2a393fada679838bddb87f4cfd9aaef631641cb72
- MD5 e89a0b897f93d7d5cb433b3fd01764c9
- SHA1 9e72e85d13fe70c2518041e30d202f04b14324b6
- SHA512 1ba55b4546cf4e1df9f0f48c7cc2ba55dcc1a6eb837f0678e77f88f37e1e6d3a17d5292cefdb4a063ae5bf31bc3757b07fce790123639d1c8686187dcc664468
- SSDEEP 192:CbBTOv+EgIRtac3iIs8YviqeOLUVw1z4ra2ZHouB/By0t/WJIGWr69PuCb:gIvpAcJOLUqFkP/By0Rx69P3b
- TLSH T1DB522A0577B04BB6DABE8F7454A183088376BB4E1943EA8E8DDC54C62F367D06205BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Plugin\ReverseProxy\ReverseProxy\obj\Release\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0da1bd8e67d6f499cc3b296fc278103497f7ca2f692fe76e3c0413b0e14df777
- MD5 7f3a6c23c979f840d98b8b04a583cde9
- SHA1 941c50a425479c5f025fbb152a1a0754ac03c252
- SHA512 47e6a880bbf3975d39c6ccac81245310683747d1b4afc152e6edaa564f43b7f042a43309844f8ff44006ce55bb810d743405bd974f5ee61b2c2bd080f2253dd3
- SSDEEP 384:GuDs6RbLDm9jJ5AftugdseXG88nhiU7eugRZAhrcvlxdBNI2qIcidq4jkcEjI+aO:L1969jJ5KugTDvYQv722TdPH3lEZ
- TLSH T14CC22905BFA8A623DB6C073CA4F3131543B1D56B7902EF8A5CD850E68B13BDB8A117D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e06a66122af82580a883ce21609f89628e5dd648726307693d398c0661a1e5c1
- MD5 d405b02cb6c624a7df4ebecefc5d23a9
- SHA1 0272d8cc3456a9bdfff7431f9ce238c93511cacd
- SHA512 b3367dc44e1488c62689cefb8940f58d0725f498850acfc18fe9d84d526b860a2ff3fd995fb4f4c2876eac748ac34381dc6b051d31df8cf2f3979d087175ba66
- SSDEEP 384:Yo7mTJ92TmR0EMZadseXGUDfhD0uQ5MZm41RCqDjbAFUYZE5xWfNxTa52p7L5:YoiTJ9NOVa9pX1KmYZE5xWl5g2px
- TLSH T168C22B066F9896A7D76C077DA8E3030843B5D1BB5903DB4B6CD490E62B53BF60B60BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\SantaRat-main\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Borat/bin/ip2region.db
- SHA256 5948907df4a4782d5954499b65ab011e257fc5775f81e0b8b4dea6fa10e6fcc5
- MD5 c8f4c82b2cbe02d7797dd6568533ae5a
- SHA1 92893bf95436d087b55ad3bc1ab6b8a349adc2d3
- SHA512 151ef56eb99cd29e02dd04b2dc19284597df2feedba1e1fbb6bbdf65f5f66fd2f9caffc48057ac1cb684270739ecddff6098b9b97b80ecfb98e277917f174c96
- SSDEEP 196608:ShLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhS1nUzBPeXQtG:DP+Zw6NLIsFfskh1BmXGG
- TLSH T11096F120FCEB7A97DA638E38D0335B2BD771410A676680C9DBE5176EB33D64D402271A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
Borat/raw/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 995ef0a042d5b5b8fa9754e7c741c59e633167f510c3dfe8bdb0373debddb24d
- MD5 ffb1320290cfdce0cddbf4ef17dfe898
- SHA1 95f706ab3a21551d4aaebda1879af62afe503879
- SHA512 ca48c519ecf12917836070e6f807e13e6dbcad241d0134c5c9a6a2412567d6ae4cadcfaef9e6c76446b1a426daa57fe1fab56b505bc31f5d0bbec47e758b642b
- SSDEEP 768:kdiv4Kbwg2V+YV5cfADYI1WQZConqLMh0AoE7pwaambG4lRueJNNQhXIxT:k+b9sCKqLzECafbX3uoQpIxT
- TLSH T1C8434A043BD8859BD3ED4AB8A8B2535582B3F3632602E79E4CC491F609177D74912DF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BoratRAT RAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ