General
- Target rat.exe
- Size 986KB
- Sample260626-sra71scv7v
- SHA256 9c4e861d7a760c8bbd23525fb1a34321e7a40d721ab78495d758815d8e01e926
Malware Config
Targets
-
- Target rat.exe
- Size 986KB
- SHA256 9c4e861d7a760c8bbd23525fb1a34321e7a40d721ab78495d758815d8e01e926
Score9/10Renames multiple (2431) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Modifies Windows Firewall
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Drops desktop.ini file(s)
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1