boratrat | 758da04589faf3a8aedeae4f9e26c90c4a7530f5e8368a368efe8ef792f167d9

Sharing

Copy URL Twitter E-mail

General

Target
BoRat Rat.7z
Size 8.6MB
Sample260620-3cypwaat2n
SHA256 758da04589faf3a8aedeae4f9e26c90c4a7530f5e8368a368efe8ef792f167d9
MD5 320967ea4c3f77c31cf5b8a7c7281db1
SHA1 4604180a62e0c5e8df87b9713213551aef8f911d
SHA512 7e6f5d8f98d38aa2ddbd26c9eee10492d01f42f822139f227b85ef4807503522375e07c83f3ddf98cdda228061041a972bed77f412cece8338360cabae5ea2bd
SSDEEP 196608:MadsOFP+sWfx5xbDe5OK2bMQy/dc7FzuU4MO0KJN+0Dvo+l:/Gt5TbaN8MQy/dcgMO0t6P
TLSH
T16B9633DF16B825B573621FFD763F45A450938A0B2F78B8840EC90461A7396E9CAF811F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BoratRat_Cracked.exe
- Size 20.0MB
- SHA256 9e7e71f470c44d253d72a78f1ccdde34b4a0bff6242d86006cd6e364b6bbf79c
- MD5 c68cf8d1c438a9c59878deb36d17e197
- SHA1 fc6158fbab2762f1da42c7a486fd04bd8b547f05
- SHA512 67bad918bf1b4d1d1461ae949c7ef9e953fe447df46e7d32484914ef74cc658d8746b5bb2fb354f8c07fb961d9e4b395e7c2dab4e49e6b26d0af51aad5b27ccf
- SSDEEP 393216:nm2XTCP+Zw6NLIsFfskh1BmXGnfBd+Ly:nmmTCP+Zlnk0rmkBYLy
- TLSH
  T16E27D000FAE4CA56D07A9AF5D0B306759BB0AD19E72287BB1180BB5D3EF37447816327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

boratrat keylogger rat
- Detects BoratRAT RAT
- Family: BoratRAT
  BoratRAT is a Windows RAT and keylogger written in C#.
  rat keylogger boratrat
behavioral1 behavioral2
- Target
  bin/Audio.dll
- Size 23KB
- SHA256 df31a70ceb0c481646eeaf94189242200fafd3df92f8b3ec97c0d0670f0e2259
- MD5 9726d7fe49c8ba43845ad8e5e2802bb8
- SHA1 8bcdf790826a2ac7adfc1e8b214e8de43e086b97
- SHA512 f97bc1e2ecbbc979d0eea3559c2da0982e4617eb217603224263ef825b8d98b3c52392eeef41888e6295fb60d362f9521e2f2bdaccc762c4591565f9e6248658
- SSDEEP 384:cSRj1EfmW3sHmH+6kBdseXGDfICDzu5RQ0juAa04FOkhcV:cSRj1N0sHieK/7CuAhROw
- TLSH
  T11AB21A02BFA8D7B3DB9C077854B353502775D1A66802FF875E9840F69E137CA1A227CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/Discord.dll
- Size 24KB
- SHA256 8fa7634b7dca1a451cf8940429be6ad2440821ed04d5d70b6e727e5968e0b5f6
- MD5 7ee673594bbb20f65448aab05f1361d0
- SHA1 2a29736882439ef4c9088913e7905c0408cb2443
- SHA512 f5d8457279a5c0684c075eae2d3de62b672303520a1c725b4f97787961e6043c73ca68d4353e5d4168a427104be65b74a9c92a87419348e92d772368e94fab7c
- SSDEEP 384:d0FmIXW/ppmaCnN594J+Im/tvp2BdseXGcdh+JaL6EWAVuk5mSZ7rN2TD118Ksuz:sECaC7iGqQ0jNZ5mSZZWDEKsK
- TLSH
  T14CB21802AB549773DBAD47BD457313148378E2A6A903EB5A2ED860F21C133CE4F61AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bin/Extra.dll
- Size 31KB
- SHA256 6a4f32b0228092ce68e8448c6f4b74b4c654f40fb2d462c1d6bbd4b4ef09053d
- MD5 62c231bafa469ab04f090fcb4475d360
- SHA1 82dda56bc59ac7db05eddbe4bcf0fe9323e32073
- SHA512 515fbdc9e792bd7ab711261c1d0185351079a2d5b104211c559cfc4c8465794ef897c43f0f825b4fc2e97a56525f73c3ad0a28de0fcf8b8bff89c26d1c97b3cc
- SSDEEP 384:UX8AFmmb7f0BOheE6qCt57udseXG8WIThDkz7R3bu4Uwvs7c9K7ZvTbJlXKyckew:E8Avb7fwCk1uLRkVsA9K7Zv76keFBFu
- TLSH
  T156E23A062F6CDA37DEAD477598B307184376D65B7803FB0A6CD420B86E83BEB46116C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  bin/FileManager.dll
- Size 32KB
- SHA256 7f8a306826fcb0ee985a2b6d874c805f7f9b2062a1123ea4bb7f1eba90fc1b81
- MD5 4ccd3dfb14ffdddfa598d1096f0190ea
- SHA1 c68c30355599461aca7205a7cbdb3bb1830d59c8
- SHA512 2fa3ea13054d84e1a307ddc63f2a364c760b8e1882fee975585e6e1bae41cad3463495d22d0c8fb77d40e6b0336c3537ab68efb5fd84e46063a336ba20672cbc
- SSDEEP 384:GEGHWHugXvIgTmm49cj7ddseXGMBNhD8mouIXA4Pcg4lYzMnIqE7GMiBrNelgPU:Gb2fN49ydxZyXMXLnIr7GMarNc
- TLSH
  T10DE21B00BFA89263D35E877968F3431802F5E46F6503DB4B8CD820F66B237EA5A45DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/FileSearcher.dll
- Size 277KB
- SHA256 2d9625f41793f62bfe32c10b2d5e05668e321bcaf8b73414b3c31ef677b9bff4
- MD5 0b7c33c5739903ba4f4b78c446773528
- SHA1 b58555bebddf8e695880014d34a863a647da547e
- SHA512 d3ea78dcc15e5f365df55558b911f3289f516ecb16c07b7132084ec2e3b10f496d1ef0774416775c14caffbf3107220cfc19ec910cdb2637561b12a23fd1e43f
- SSDEEP 3072:EGFYQ/KZdG6oE1nKSYfTvqCjUKidQTs2pccc9k1DEIWcSCSLeyYcEeI/KQ73WmbN:EnwLrSYfDjtlAx9k1An4pE0
- TLSH
  T1AB544B406BE9CA57F1BF27B6C0F3525187B8E152A57EEB8F4C8014EE1917340DA217AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bin/Fun.dll
- Size 33KB
- SHA256 dcac599b1bab37e1a388ac469e6cc5de1f35eb02beaa6778f07a1c090ce3ea04
- MD5 499fc6ac30b3b342833c79523be4a60c
- SHA1 dcf1ed3fbc56d63b42c88ede88f9cad1d509e7ec
- SHA512 b63dcf0f42a4e80747556000aeee72137735cb7177567df6cfef3f15471efb8c4dc797db8cdc870d66cd87f09ffc7ab177969b126825a69e4b5390b568462484
- SSDEEP 768:DOFmXPm7MACQnB5vrTh+g0R2Lybx9gnn:DOFNnB5XJL8e
- TLSH
  T1BEF22A08EBA5D677EB5C0738E4B353148375D4E36402EF8A0CD820E66A477CA4F65BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bin/Information.dll
- Size 24KB
- SHA256 a15d72d990686d06d89d7e11df2b16bcd5719a40298c19d046fa22c40d56af44
- MD5 87651b12453131dafd3e91f60d8aef5a
- SHA1 d5db880256bffa098718894edf684ea0dc4c335d
- SHA512 1b911a877c5a3f508421f4f250d95861a5c110cb4b67ffe05de157085c5a018d34d9574c1ef4cf9eec3ba3cdd39985863564ea2f77814812032ea796cb329afa
- SSDEEP 384:zsvmkKbpmUGZdseXGvXhDYLuqInXx3McZ+RaYzwM3tllsXxMSDv:w+kKb0bZIqInpXZ+RtzAxMSj
- TLSH
  T139B20B01FBA8C763D7AD1B7957B303084BB5F5E59822EB4E5D5010B6192B7CA8E213D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/Keylogger.exe
- Size 10KB
- SHA256 16beb1ae2de2974ccc2371d9f619f492295e590abb65d3102e362c8ec27f2bbb
- MD5 a45679bdcf30f068032bd37a194fa175
- SHA1 f23fd98f28bb0b482f0aae028172e11536e4688c
- SHA512 3b6a954de9ec3b82719af8c3fd3de2137096b182990363abc8a68e20c1d1d419fc594a7955759a64de3582a92662315a3ead8193c2806efcff113dc2c61c4518
- SSDEEP 192:mStmcuq6QIDxi4maEYbRzmEsLkugv5JHTeeJYHcwY7fazItxEEi:mStlF6QmE9rUhVsLe5perYyAEE
- TLSH
  T17C220981BBE88775DD7927B698F747501570E2055C73C9AF1898111E3EA72410FC3BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/Logger.dll
- Size 26KB
- SHA256 2f258949fd95da6cd912beb7203a9fd5e99d050309a40341de67537edb75aadc
- MD5 872145b37d107144894c9aa8729bad42
- SHA1 01610587bcfa7ac379b1f0169a2a9ab384b9116b
- SHA512 0c926d24515b8ea80586c80d2613136f802badde3a788d2960ebd8f6a4d6e901d1ea220262f3d2a852c4f3da88bd69915070de920bc79eb82329c44dcab98435
- SSDEEP 384:ny2nOVC1a1WmAcsH2Co9KPdseXG8iIhDbuLCG4kNmXWuxb87AMFah:nrQ1hNsnPZ1Jk6875O
- TLSH
  T1FEC219057F54D7B7CBAC1BB898A7530543B1C29B2C13EB871C9460F64A537DB0B16ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  bin/MessagePackLib.dll
- Size 16KB
- SHA256 adb00dee751b4ba620d3b0e002f5b6d8b89cf63b062f74ec65bba72294d553d1
- MD5 590b00c87d5ff2ffe09079f0406eb2cd
- SHA1 92c91f1db8c2c8cc34c2e1a26f4f970f1518a7ed
- SHA512 9396620bb9d77cacd7bc2bfa44e8fb76091e314298434d8ba995595df0b2a13edf8229c465b563aa668702176ccf2de34e9fd3d1567d4ff20d94672aba4ad745
- SSDEEP 384:omnkO72iseXGr8puUUqmMDRVE7PuFRQ5:7nkprnJMDRVE72I
- TLSH
  T1AB72C706AF599623DA6D07BD94A303045735ADA1A403FB9F4C58A1F25E233CF1B727CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/Miscellaneous.dll
- Size 82KB
- SHA256 f91973113fd01465999ce317f3e7a89df8c91a5efadcfa61e5ccce687bf3580a
- MD5 509d41da4a688a2e50fc8e3afca074c7
- SHA1 228de17938071733585842c59ffb99177831b558
- SHA512 86f975c75e246100d0486aa1507f5c2030323649ae921af51583c6b287e6780e9a9bf887ef4ead11599742cdeb7c90380c7d4859340e11913c2c1f42fb34ef8e
- SSDEEP 1536:+Zce38lSJ3k45otUV251nos3O4Raam/an:+ZceRU4KSV213O4Raat
- TLSH
  T1CF836D156BA8D927D8BE1BFA34B3061853F1D551B213EB6B9C8414EA1E137D20A237CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bin/Netstat.dll
- Size 24KB
- SHA256 7eed1b90946a6db1fe978d177a80542b5db0bf3156c979dc8a8869a94811bf4b
- MD5 12911f5654d6346fe99ef91e90849c13
- SHA1 1b8e63d03feb84d995c02dcbb74da7edfaa8c763
- SHA512 588971ef7aebae7afffb22bafdf8f8bb04bf3c474eabf6637543fe42e3e1800cc824929d953055a4f666776ea5fffe0389ef6216c1dca437e0c8a330f6670c19
- SSDEEP 384:crl+bbgmsHmxSRmqe5HPwKRsJGAdseXGOhBReDmYuFCJG0BBR93NNRk+rs25x55/:cwbWGcMqc45L6eC1B79Tk+gn8sO
- TLSH
  T109B2F905AB68D777DF5C077DA8F3030903B8D2A66512FB8A5CD830F61B067EA07656CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bin/Options.dll
- Size 378KB
- SHA256 c9b8e795c5a024f9e3c85ba64534b9bf52cc8c3d29b95ff6417dc3a54bc68b95
- MD5 3a474b8dee059562b31887197d94f382
- SHA1 b31455f9583b89cac9f655c136801673fb7b4b9a
- SHA512 cdda908adb88603302b33c99befed0394f12cc34c5a31bc7b4b614df3615ea8a6cad7ef84e7b9865342f33783006974027e39fd458e5936dec14c8ae5e98bf0a
- SSDEEP 6144:DTG2nhDLZ03+biuOd1jScGHkl6GfIrOzXevKvhzmYVV7+FWWz06v:/nnzEYcVXevWBVqO
- TLSH
  T1DE844C11DFE4C237E9BE17B5E8B3024147B5E48BE566EB4F988864D81C63304AD127BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bin/ProcessManager.dll
- Size 25KB
- SHA256 5b1f80ff787bdcd7ee12aa64be1f2f5f1f658bd644bbc5fd73527b51da6ce0d6
- MD5 91edcb945924df5fbf4ff123aa63199c
- SHA1 d124869aaee9aa1a49def714774b834335aa746e
- SHA512 6927c1576a8a9ff724fe3b7d53067f97c121b272c1f2528cb8aa1806de61f36504ee4d25d56eb717a1010a80fb6b5e37c1a0c30b256fdb9a5ba5b31794146c52
- SSDEEP 384:IiL3RGwNe7Nm1T33T9OZNA8SwCguRvsPzHdseXGii6ZDWl9UZ5QDBfqFuGvAzx/B:IiL3A2eg1L3B7wUvsPT9mGvixVX
- TLSH
  T12CB24B056F88E777EABC077AA863531447B1D1B6B402EB8B9DD824F22B077C90A117D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bin/Ransomware.dll
- Size 97KB
- SHA256 54f554b9e330476b3903756f62b577bab35cdef941d3d0f6a3d607862762bf91
- MD5 ef998529d037fcdb2bde6d046f99db45
- SHA1 1a38a1182155429ecc64c20ece46ec0836c32ec7
- SHA512 4e4376c182dcdf993c6e8f55388829b9e7057e8d80be268a8469721e8ac7fc29eab65681f0f7f2c0dbad1c5bc30fdcc123774ae543770090bf01a62a0d161ece
- SSDEEP 1536:hQaxD6uxxNV41T56kDgJp+isYOmvZfi3OqL4FrQ1vbVa:Kax2uxxNV41T5lkjvv83OqLKU1Za
- TLSH
  T1DBA3FA152FC486ABCAFD56FE7DA542180BF0D2D6B002FF47494864662CD33A3896D68F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects BoratRAT RAT

Family: BoratRAT

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32