Overview

overview

10

Static

static

9

BulkFileChanger.exe

windows11-21h2-x64

10

Resubmissions

22/08/2026, 03:37

260822-d6gwsavway9

16/07/2026, 03:36

260716-d5xwlsfx6t9

16/07/2026, 01:46

260716-b619badz6x10

15/07/2026, 15:01

260715-sdw8bsh13v9

14/07/2026, 13:53

260714-q66alagy4w10

14/07/2026, 13:36

260714-qwkk5sdz8r10

14/07/2026, 13:36

260714-qwbm8sgw6z9

14/07/2026, 08:33

260714-kf7g3shv6k10

25/05/2026, 16:27

260525-tyaeqsgs5z9

25/05/2026, 16:09

260525-tmaalads3p9

Sharing

Copy URL Twitter E-mail

General

  • Target
    BulkFileChanger.exe
  • Size 130KB
  • Sample260525-st87tsfv9w
  • SHA256 69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
boratratadwarecredential_accessdiscoverykeyloggerransomwareratspywarestealer

Malware Config

Targets

    • Target
      BulkFileChanger.exe
    • Size 130KB
    • SHA256 69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarecredential_accessdiscoveryboratratkeyloggerransomwareratspywarestealer

    • Detects BoratRAT RAT

    • Family: BoratRAT

      BoratRAT is a Windows RAT and keylogger written in C#.

      ratkeyloggerboratrat

    • Renames multiple (8009) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks