CraxsRAT VIP7.6.rar
- SHA256 34987821b66ff27704d422d3c7b741888b7faae9c740e2c8133ee3e2dfffbeb5
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
| resource | yara_rule |
|---|---|
| static1/unpack002/VIP RAT 7.6/LiveCharts.MAPS.dll | agile_net |
| static1/unpack002/VIP RAT 7.6/craxs.dll | agile_net |
Detects SmartAssembly .NET packer.
| resource | yara_rule |
|---|---|
| static1/unpack002/VIP RAT 7.6/craxs.dll | SmartAssembly |
Checks for missing JAR codesign signature.
| resource |
|---|
| unpack002/VIP RAT 7.6/res/Lib/apktool.jar |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack002/VIP RAT 7.6/DrakeUI.Framework.dll |
| unpack002/VIP RAT 7.6/GeoIPCitys.dll |
| unpack002/VIP RAT 7.6/LiveCharts.MAPS.dll |
| unpack002/VIP RAT 7.6/LiveCharts.WinForms.dll |
| unpack002/VIP RAT 7.6/LiveCharts.Wpf.dll |
| unpack002/VIP RAT 7.6/LiveCharts.dll |
| unpack002/VIP RAT 7.6/NAudio.dll |
| unpack002/VIP RAT 7.6/VIP Rat.exe |
| unpack002/VIP RAT 7.6/WinMM.Net.dll |
| unpack002/VIP RAT 7.6/craxs.dll |
| unpack002/VIP RAT 7.6/res/Lib/7z.dll |
| unpack002/VIP RAT 7.6/res/Lib/7z.exe |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=105, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=224, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=75, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Nov 19, 2021
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned JAR
Checks for missing JAR codesign signature.
Nov 19, 2021
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Nov 19, 2021
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US