castlerat | 65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650

Sharing

Copy URL Twitter E-mail

General

Target
_65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650.exe
Size 24.0MB
Sample260619-v8dqksh14q
SHA256 65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650
MD5 ce6da0cf1fc33dc1691a35445146ff05
SHA1 4b7d93c1da2549d035626d1d1b6a560492db4375
SHA512 2d888c6675ec1526d2a1614f94ccc8189856f5cf01eb719f037a94bf8dd9e9d07ae0105f62668eeca0e452131593aa4d02c4a294f9cb397a599cee7726ccd608
SSDEEP 393216:LWMAQHdmh2verOQfou6ZxJdtosHHnjcvv7QoiLW6b2lV97pdeQQqnzfCy:LSQH8G0ougHvHgvclLW6b5uCy
TLSH
T1F44733FE35E0DDD8C705BA709B7233F252698D1171862B9C84EB3DA0EDF0096A91774A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650.exe
- Size 24.0MB
- SHA256 65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650
- MD5 ce6da0cf1fc33dc1691a35445146ff05
- SHA1 4b7d93c1da2549d035626d1d1b6a560492db4375
- SHA512 2d888c6675ec1526d2a1614f94ccc8189856f5cf01eb719f037a94bf8dd9e9d07ae0105f62668eeca0e452131593aa4d02c4a294f9cb397a599cee7726ccd608
- SSDEEP 393216:LWMAQHdmh2verOQfou6ZxJdtosHHnjcvv7QoiLW6b2lV97pdeQQqnzfCy:LSQH8G0ougHvHgvclLW6b5uCy
- TLSH
  T1F44733FE35E0DDD8C705BA709B7233F252698D1171862B9C84EB3DA0EDF0096A91774A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tag_150 apt discovery castlerat persistence spyware stealer trojan adware ransomware
- Detects C variant of CastleRAT.
  trojan apt tag_150
- Family: CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NScurl.dll
- Size 7.4MB
- SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
- MD5 db425209aa38a6f6d8379f441b99950d
- SHA1 951baa838310b9352dc9f8923ea7ada206efab94
- SHA512 dd96e9ffb4c38bb3826ea0c178b9bfd71d38ce6d9f1887d3262c4ea8313049d2ba7b9a5279980d8981b8cc49929801e02ccd5fe48dffe7a787e9cff658592741
- SSDEEP 196608:gfb4qtMPEdoSlT5x4Ww4EbEEW7IDqlcT1VuDx7Kk/fcHLKoW:WqLK
- TLSH
  T1A1764A94FECB04F1E55784B0D8EBB37F8B34A7118125D6BAEE0C1E56F933701261A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  app-runtime/DLLs/IronPython.SQLite.dll
- Size 629KB
- SHA256 fb87b114a989fac71ee047f9a528b555a0fa69d4a74d17b7b587cbd6bbd94acc
- MD5 fb3e0d62dac3724f25ff7bf74303e150
- SHA1 8e151fdba2fca83ada22c40d13825803257acc01
- SHA512 6666caf3b89f989de29fe658a4255e7539c9751c50ce6ce9feb7d3f444a68f49be804eb509ed2941f9d2549d6ebeb3156a9fc88d7dfe79db67721e1dea34ff0c
- SSDEEP 12288:znzEx5XFUMGmq3aRyGq0Lq24SyIX4Zah:znz6FUMsbhwyIoU
- TLSH
  T1BDD44B7A6BC82923E5FE5B30E0201D5943B1F015DBB2FBCB9944C1B62867790ED647A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  app-runtime/DLLs/IronPython.Wpf.dll
- Size 7KB
- SHA256 35e434d4bc103ab47ab1441051538cb34c7600cafc5c89f96e9f3456bb5d2537
- MD5 ad8de7f7c3dddff0f39ee59a99c07d54
- SHA1 12922d887e774cb8630f74904970ff69b6dd6cfd
- SHA512 76896e2402bf1792ecdbba6a25d0f0d6fa47716b577852b0d14692e0173c4ecdad6a163ea8fd4073ab22926e3c256222951ca1ed74a636add68696967fe72dec
- SSDEEP 96:TqhD+g2FEPEAj+U1cZY7ECPt4/FpK95rNZHRTGucQR12i:TeD+5FEcy+acOWFg9RTbDz
- TLSH
  T1A9F1C872F7B5063AED7F0777D8B7164442B0A6029863EF2E0CEC81872C6915496727B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  app-runtime/IKVM.Reflection.dll
- Size 396KB
- SHA256 0718c32f2184fe2b177a9f1dfadfcffcc2c1755de84f659730ba237e13339af7
- MD5 2ec8b6f478e732d34f6458b47cc83016
- SHA1 9d833125c1b4fcae8b49c8deb13d681d0bbc63f7
- SHA512 6ad6a512471702967e67b76075ef7e458500a7ec6a3da08841d8108ed287b1f9a20144420303ef95d12910f5318b3a7e8051e35f947732f3910cd281d2e366aa
- SSDEEP 6144:ehLd0dqmZ1kDT71h14P8pUykhHGQppTIeAg2J9Q2v8DV0WTXVYXFdm:eFd0dqhfB3CykhmQp9kOV0WTVYi
- TLSH
  T1288459146BFC277AD88E8372F4A24C2853F5D22562DFEB8D8D88BAF51C57B509C11623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  app-runtime/IronPython.Modules.dll
- Size 783KB
- SHA256 ceb8f979454511cfbc0e418139a3874dcdeec86adc1ef27122f8af61c2f3af60
- MD5 7e98a6056c2978afe12e38eafa99be0a
- SHA1 899787e7666cfaf65d3a2651f7a2f07bd5a46b03
- SHA512 270a6233f6703bd5e56768aa30bcc8fa3ef02b700a696036226fb6c2e635b32e083b058f86a136128e83680104194de6722b21cacb984dd8b5b019026c51ee63
- SSDEEP 12288:JwNw4zDMDLJPcGOevRSUJvrms0hZ8st7Tgx5aIvcXUgKDI9Bd/WN:JSzDMD5vlvRSwr0tngiIQFEN
- TLSH
  T129055A1677E85B07D5FE5BB0A4380A684370F812AFA6FB5FA84495EE1D927818D007F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  app-runtime/IronPython.dll
- Size 2.2MB
- SHA256 781b795b614a46596268c3742b0467519950d928407852df18bbd7b3b9f07871
- MD5 81b3c3ecb4166e78dd2eaecaccb3b738
- SHA1 0bc2d0154feb7dac6cc7ea38ab754a7f7c50c3c3
- SHA512 2be80a85155c6ba9c0dcff73ad4fcb4bfae847101ae58d93b4525f23613f58bc4862b28cae0c5496ff8af792f2f30fde89fee58bed21717e374c82affa28e520
- SSDEEP 24576:j+B0VRHr2Tdsters8K6U5v74EZoZjw5YoHH0tyPNgfo7zPCH+:jc0DidsYrrK6AXoZjw5ZNggnPC
- TLSH
  T19DA54A5137F86E17E4BF8734E0B1902497F6F86A6B93E34A7609A6B51F923014E413E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  app-runtime/Microsoft.Dynamic.dll
- Size 832KB
- SHA256 5810727322dfed8919dc6ff1e98d9c123aff04de2ec92cef516b648f2ff97294
- MD5 c7a9e8c38a08cf992b86921455801a0c
- SHA1 99fefd4769285d796a6b8bf66fc966d35a195f60
- SHA512 7cc02b4d77c912925d8bc098e62f72acef7e6e316fbb5119d6fce357c41d8d887d4257bebac9cef36c4a519683acb050e06ea6da7fc9c556d871c9d9f8629267
- SSDEEP 12288:XDPS7ulgnQ0bA1bp+eog7khhWhhWhhI6oD9zBqR+:TgupehhWhhWhhHoD9c
- TLSH
  T15D056D4233D8DB5FC6AF9775B4340A2853B5F546B2AAE7AF64A0AAE40C833104D547F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  app-runtime/Microsoft.Scripting.dll
- Size 142KB
- SHA256 f1aefa13b2879eb883027c22e0c72976e34d88a95572588de77de3716d9a573e
- MD5 6084eb0af148d2150146752a8c06c1a0
- SHA1 c3427a546e0e1af230e10790e3cb12151a86278b
- SHA512 38880018d57eb4575e7abbe3794a6c0b5d868ee58c3953a6c1b592442a553cec86fd6981fdbffbfcdef2c5ec0f94050629cc849e72f88562603e4a7bab46a349
- SSDEEP 1536:pgg/O0lPQeGGQhcj8EP3gQ4D9PlzPunMy3EoVqie173nRw+:pTOiGGQh8CDjcMn6e1Tn7
- TLSH
  T140E3274527E88A2BEEFF1A7EF07106140B71F91BA537E78D1954E8EC1823B908952773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app-runtime/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app-runtime/System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  app-runtime/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  app-runtime/System.Runtime.CompilerServices.Unsafe.dll
- Size 16KB
- SHA256 66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
- MD5 da04a75ddc22118ed24e0b53e474805a
- SHA1 2d68c648a6a6371b6046e6c3af09128230e0ad32
- SHA512 26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
- SSDEEP 192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
- TLSH
  T1CD72294A4BA80313ED736B309AA4D443FE38A7D75812D72F1985F1B91CDB7D4AF21628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  app-runtime/ipy.exe
- Size 23KB
- SHA256 682bc2da9592993a58e72062cbad61db8f219c694f5d6216c8082d7fa249fa65
- MD5 b0d944916e843585a40810c1a17f329d
- SHA1 52e507f91c2dc6eb9822eb94ed6c52ab61085a30
- SHA512 770c8d24e7b6b87ed1f9b2166dbf248b27b0837cb0a0848df711b81a104fa94ce766ccf52ab1ffc6244b8d627d34d86ad029927d8b35742434855c93adfd6b4a
- SSDEEP 384:ZpOm4fcItFc0Aq5awq+3OgOSvvtWnorqZdhsptYcFm7B03K:pWntOS3Og/vMiq9YtYcFm7B6K
- TLSH
  T197B26D4697988274C87909F4285BC3582275AF16940BDF6738EC7D8F3F76381A3237A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects C variant of CastleRAT.

Family: CastleRAT

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32