General
- Target dedsec_rat.exe
- Size 9.4MB
- Sample260625-wlaabaes5r
- SHA256 e92b71dde710a0c7f2a70bfbccba8a12ae6049e78bbb3c4b9c2738673574388a
- MD5 bf668986a4b7bb35fa3e51819e0c080f
- SHA1 190b732fb7ec25a7efc7845b85bfc562870fd90c
- SHA512 430d3018071732ccb3037eb878380695b49172060c9bbb076b9244dfcdda4e9994d6493000ec5ddcba8718983855a0a214223776b0fbda9a1196fb678eefae2a
- SSDEEP 196608:tHqOhGPqpwFM+fDv1iHRr+rxFrbwP4/V/0ecxdHF1IsS8qfINlD:ZqOreFvDtixrQEAqBXlqfINlD
- TLSH T1ECA633E06171D9E0D2327F71DEFF6ECECB8A852B322B1C4F343488554AA5AE21C615D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
dedsec_rat.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
dedsec_rat.exe
Resource
win11ltsc2024-20260617-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target dedsec_rat.exe
- Size 9.4MB
- SHA256 e92b71dde710a0c7f2a70bfbccba8a12ae6049e78bbb3c4b9c2738673574388a
- MD5 bf668986a4b7bb35fa3e51819e0c080f
- SHA1 190b732fb7ec25a7efc7845b85bfc562870fd90c
- SHA512 430d3018071732ccb3037eb878380695b49172060c9bbb076b9244dfcdda4e9994d6493000ec5ddcba8718983855a0a214223776b0fbda9a1196fb678eefae2a
- SSDEEP 196608:tHqOhGPqpwFM+fDv1iHRr+rxFrbwP4/V/0ecxdHF1IsS8qfINlD:ZqOreFvDtixrQEAqBXlqfINlD
- TLSH T1ECA633E06171D9E0D2327F71DEFF6ECECB8A852B322B1C4F343488554AA5AE21C615D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.