General

  • Target
    Collapse RAT v1.5 Cracked(Source Code).zip
  • Size 257.6MB
  • Sample260522-nw88dshz2n
  • SHA256 8fffa826434b5bc8af0801ae4c6dbc78aa162088173945d94b5084315b645568
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • asyncrat

Version
  • Collapse RAT & HVNC 1.0.0

Mutex
  • uxorrbindixq

Attributes
  • delay

    1

  • install

    false

  • local_host

    127.0.0.1

aes.plain

Targets

    • Target
      Collapse RAT v1.5 Cracked(Source Code).zip
    • Size 257.6MB
    • SHA256 8fffa826434b5bc8af0801ae4c6dbc78aa162088173945d94b5084315b645568
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/Plugins/Stealer.dll.config
    • Size 1KB
    • SHA256 63837bde3bfb609d59002b88831786e7b0bf285a6090f9252c35af9ee3f75ff6
    • MD5 SHA1 SHA512 TLSH
    • Target
      Collapse RAT Source code/bin/Debug/net48/Plugins/ip2region.db
    • Size 8.9MB
    • SHA256 5948907df4a4782d5954499b65ab011e257fc5775f81e0b8b4dea6fa10e6fcc5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/Resources.resx
    • Size 17.1MB
    • SHA256 b00bb37106f449417db0d3d9e4e73d35755e89fa9ce94582b74612bad93cecce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/ServerCertificate.p12
    • Size 1KB
    • SHA256 74eba079b36c835cd89af395cf53272c53351cd851efb140a8152410c4e2973e
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/Stub/Client.exe.config
    • Size 174B
    • SHA256 b1677d78346f02aa0ffaff28c796ba8f292ff801ec1a646909357a8298e372d2
    • MD5 SHA1 SHA512 TLSH
    • Target
      Collapse RAT Source code/bin/Debug/net48/Stub/Client.pdb
    • Size 24KB
    • SHA256 4303bb9e48f0569d6f9b941b0c3dc45a91a3ca4c798215bbc46dd2718eb81bbe
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/VenomServer.p12
    • Size 1KB
    • SHA256 c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/offline
    • Size 86KB
    • SHA256 21b4173439bdcb6338d99a8f060b98426cca95b2830b62965a72c94bc6c77236
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/bin/Debug/net48/online
    • Size 88KB
    • SHA256 c2cfbabf111d231fb2531b6c0759c5191fd91f767059790ff53aef87fab2280f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      Collapse RAT Source code/costura.bouncycastle.crypto.dll.compressed
    • Size 1.5MB
    • SHA256 7a5ecddefb79248179900e0f8a601fe7a5e41116b158450f21ca33695dfb492a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/costura.cgeoip.dll.compressed
    • Size 1.0MB
    • SHA256 6c69efe2fed875e478096a8e753de8c393ac19432a558b1df9e5b945c91d6e9e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/costura.costura.dll.compressed
    • Size 1KB
    • SHA256 74291771dd1f0338517e85182e062a96279f6e4ab8251502b8f7d1c33c6ce655
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/costura.costura.pdb.compressed
    • Size 1KB
    • SHA256 fbaa489666a278edc8ba51a9963f48e4dfe4c2d7a02f5454543fb87510b5dc7c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/costura.discord.net.core.dll.compressed
    • Size 174KB
    • SHA256 c070a12edd2871b9bd8af4c61bd4a5bbacc85e62eb2651b188de8a63f74a3135
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Collapse RAT Source code/costura.discordrpc.dll.compressed
    • Size 31KB
    • SHA256 a9b862d8c71777d7573b006aa0da2a056b8b077295a4dfc66f642478dc7bf9bf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

ratasyncratstealerstormkitty
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

adwarediscoveryspyware
Score
3/10

behavioral4

adwarediscoveryspyware
Score
4/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

adwarediscoveryspyware
Score
3/10

behavioral12

adwarediscoveryspyware
Score
4/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10