7b012876a2502848695ee3469b9439dd1dfc3134146af7d08964c35b13866273

Sharing

Copy URL Twitter E-mail

General

Target
ThirdRAT-123.rar
Size 6.7MB
Sample260719-gcd5ksft8t
SHA256 7b012876a2502848695ee3469b9439dd1dfc3134146af7d08964c35b13866273
MD5 3493f564751de4b292bd74e5e197d43c
SHA1 952d43955f86f4d9fdc6d2e488d3f90564e57c9b
SHA512 d2c527b6e745bf2e31421e532aba4aefe14a06e9efa24952a590540530ebb0095124f0a231750a5237b4f25d88c28ecbb1c46ad2e4399074fc20480f8835b37a
SSDEEP 196608:oXAluKdpaTsE/o+5YXVJv0Yv0yHXmP0nHM:oX9+paTsE/95OJv1vdH2P0nHM
TLSH
T18B663398BF91F2A62DD3B02EE2E6477C63D00902A57F51946558E9482F2C78C4BD37F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ThirdRAT-123.rar
- Size 6.7MB
- SHA256 7b012876a2502848695ee3469b9439dd1dfc3134146af7d08964c35b13866273
- MD5 3493f564751de4b292bd74e5e197d43c
- SHA1 952d43955f86f4d9fdc6d2e488d3f90564e57c9b
- SHA512 d2c527b6e745bf2e31421e532aba4aefe14a06e9efa24952a590540530ebb0095124f0a231750a5237b4f25d88c28ecbb1c46ad2e4399074fc20480f8835b37a
- SSDEEP 196608:oXAluKdpaTsE/o+5YXVJv0Yv0yHXmP0nHM:oX9+paTsE/95OJv1vdH2P0nHM
- TLSH
  T18B663398BF91F2A62DD3B02EE2E6477C63D00902A57F51946558E9482F2C78C4BD37F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Chat.dll
- Size 24KB
- SHA256 9f39e56d0ba245557f1fbdbf5c95dff2e62b41c62556f0ff1b732224e1de5de0
- MD5 261fa59771a13c83b50df237736a1e09
- SHA1 c2460464ca94f12a3e55bdcb13a17251287594b4
- SHA512 6ac6c883c3c00491ef3d86c124c2e69dab6d726bc00e15ae9414c99f495868a61cf391a835ad628ee4a81b154afcb9afea6db7a86d5665bb7e2db8702988c7ec
- SSDEEP 384:tUIVjjRmjJD7mD/PTeUzkoiEEEEEEEESEElAEEwXEE1OvBhfgV1pLr+zAHMaC8ZQ:TVHAjJGDje0OhIV7iSzih
- TLSH
  T1A9B22A04A7A8C73BCFAD0BB9A477521847B2C22B6503EF955CDC50EA5A177CE0742AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Extra.dll
- Size 29KB
- SHA256 78e94a3e22065f43c5cc4de4bcd62397153fa4912f2114c4bef1984ef4163d49
- MD5 9725addba84acc236c2bc8a89d5e2617
- SHA1 d7ced0e00cca4256d2a41c0a3cc753495f597b9f
- SHA512 24363deee9cf091d5dd4e12736440767af6eb396e3afdb64c88b428ef0621bc74912ea0c088b2840a6a60cfe14a5838148e4a0fe92eef4b7d236fe4e9c44760e
- SSDEEP 384:tXETRbFmmOFgTNv7/dseXG07xEDgS7B30uBstoui1Qehp0L7amE:tMcmOFg/FE0OLmehGamE
- TLSH
  T1F4D21A017FE89667F67D1B349DF317088776F89A7903DF4E4C8020AA45237C95A217EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ThirdRAT-123/ThirdRAT/Plugins/FileManager.dll
- Size 30KB
- SHA256 57d441422058c6a5a35df6035efce10ac90d8774333fc5020b8261f0db2a8af7
- MD5 9f9cd7cce2e544feea1b9a4d308b48f0
- SHA1 41d7fe7ad1bbc17876e80d8951cbe2647f6ce858
- SHA512 2c379a0853f164b825a7338379772d7c51b5b242f063a536edcc62a100f4995ef9dfe99490374432b8a98e4329cc35877c3569613dfbe80a04a828945186d496
- SSDEEP 384:/G7GeJ/d/D3gfmjLEzCHJC74dseXGDssEDg8mquuU8OVYl1UGza1QLuwbXMQMWX:/Q9d/rgO/Vi4Y4pUHCv9SUXMjWX
- TLSH
  T1A2E20914BFA4D653E77C4338A8B3231C02F6906B6652EB4B9CD521F11A2B7CA9711DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ThirdRAT-123/ThirdRAT/Plugins/FileSearcher.dll
- Size 123KB
- SHA256 9a7e510d5afb5c026a215a4102154cd03c03988294645ae3c5374f666ad5a40f
- MD5 61f19c84af875f69b1c23e351e24b945
- SHA1 19015a4d85791f9be80f5fd73a95a6eb4dd0b45d
- SHA512 abb8445cdd73c9147163d588cea4f1a4e77a14613053b6ec1312cded848aeac65ab256d5e38daf22d404a868e218905562703a6ef88b26146d16003d96d2b694
- SSDEEP 3072:PGGaSHMdcvIe3NFJutuI0CSXVGB9yDXcfZn:PGHSsdqjJiulCcVWi
- TLSH
  T1E6C3029863989F52E1FE87FC3A6263808ABDD503B911C3C5ECC861C55B59793EB70892
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  costura.dll
- Size 4KB
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH
  T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ionic.zip.reduced.dll
- Size 247KB
- SHA256 a4009288982e4c30d22b544167f72db882e34f0fda7d4061b2c02c84688c0ed1
- MD5 7c359500407dd393a276010ab778d5af
- SHA1 4d63d669b73acaca3fc62ec263589acaaea91c0b
- SHA512 88a25138d0a491e5ee27499206e05b8c501da0c73ad2b3e23d70e810a09bfc1b701817de7f22c9f0b9f81f90235fe5eeadd112773035a11f01706eac364b34bc
- SSDEEP 3072:nrI52ReHNdAFnfPPShREuMPb9YlVVRxpop2i0KKCXrXSbS4KcMy8ZZL5QlcSCSLw:yNdA+Myl7TpNiWCL4EycZb4
- TLSH
  T15C446A1423EC4E5AF1BE6779C4B782A0C3B1F456B93FDB4E9C8450EE2816790CA117A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  messagepacklib.dll
- Size 15KB
- SHA256 554baf35f287e506dfae1c02ba34a3173b562844e5edf0a5e6a88ac07826e572
- MD5 a2d93983e4578aa5a43d4b47902a6d4f
- SHA1 a4f50a6d6b4058a9e549989d013665d15d4d8073
- SHA512 890ce6764e329e6e182872d3177aaa3b0e3055125dfaedb884bebb2574966ecf9f22a23347e1e2d76aaf98dfc61f851eb24a59c1c5bcf05306540bc4a6f3ffad
- SSDEEP 384:DmZ3HB+JII+nlmIuDG9+6tDLtMT1QZjb2Au:6Z3HPRUIuy8WXuRAu
- TLSH
  T1A262F7095B689737DBAC077DA89B03404734D9717402FB1E1CE490F26E2B7DF1A62ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ThirdRAT-123/ThirdRAT/Plugins/LimeLogger.dll
- Size 25KB
- SHA256 5a8331f261df87ee0b014f94472f6e5283e7be2c7612f1227ad9cf9f07b05002
- MD5 c1ab55d239ab7087d4e203932dbf6abc
- SHA1 73f76d7703f3e8cef56d153cc2d81a76b3775977
- SHA512 9a949f29fa207c9efee73551293b4156607d6824b6e602d6ad975e3f22cff91f7a012502b7356f83f1e5f0270f1e1c3c2bc157803f81e4b1b907d3bfa09f34f0
- SSDEEP 384:cgXy4TVo1a1/mbOqB9btOKPdseXG8IdEDggu1LBsWJQgrnbfuaQV:ca1uqqrPZDKp9rnjuN
- TLSH
  T168C22A057F98C7B7C6AC17B8ACB7831643B1D1966C13EB875C9810F60A533D75706ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Miscellaneous.dll
- Size 90KB
- SHA256 9ae9e696c488cefdf7d1bf071d3141f41299d791f3fff078d1ddf582f49f0abe
- MD5 a4a4837d61d56dfb5dda9d247e45de8e
- SHA1 a40a944efb455d254b46fc0f0f286138ef91c8df
- SHA512 e702c2b2f1d59fd3cc9ed20ccc430185d4deafa39c0ca0fd33836143fc099c5c9200159017906a56bf337514c5f502ad5deb322cb099e22f1fb41cf2ec2bb513
- SSDEEP 1536:S/uamNPCs3SvpqnS99qYofrWV2klnn83OQ4Qfh0eut7NFuMko0DC:FamNPCnvUTKV2b3OQ4QfhTutBoJvDC
- TLSH
  T17B936E186FD4C92AE5FF8BBA31B2194843F1D056A523DB4E5C9420E65F633820B277DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Newtonsoft.Json.xml
- Size 553KB
- SHA256 bcf6406c1cdc42e378c8072ae511a29e34de2affdefabce9fc96a8b0321e3f15
- MD5 7349351bdd2cd0279fc36c2cc0f09532
- SHA1 8bd801ad9f14b3bc1b756e5db597c27fda33d6b7
- SHA512 94d9b930bb57d99a521b43c87e5cba9a3d3540b78249c4af1a5a8d95739f8a8bc3c80cf4cbe6776b71488b9e943e851d398f2241b3bd63bbbf007a3b4ce4896a
- SSDEEP 6144:XqqU+k/RikErH6dl0/IHHXpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUD
- TLSH
  T15EC49D2976C4CF220C7A012A4D1CF0C5FF2009B716197C96358C5DDB9FBAEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Options.dll
- Size 27KB
- SHA256 bfc1eb302275c85c92a559c552ec58ef1d799e2b02839fc18c6e0fee88b9d5c9
- MD5 0fad31d6c007cbe62f77c805c32ffe73
- SHA1 d05922c64edffc34ca0e7e56ea9683bbc08309ab
- SHA512 78870dbca0eace4b4a291a332be14f2c9c29bcb6198603ab84594b743ce7ca6fee4faf80b08dc6926dc85cbde2999640a4b08418d82fc290ac2b25d6c4d211f1
- SSDEEP 384:Z5A+KmSrODx5w74vdseXGZcbiEDgs7+dz6XRcy5R8FSzYSK5MC4DV6lMkRNsB5G:Z6mSrODxi4vC89nKFbSK5opkPp
- TLSH
  T1E3C23B01BBA8C7A3DA6C5778A0F3531103B4D55A6543EF8A5CE920FA4F137DB1A127CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ThirdRAT-123/ThirdRAT/Plugins/ProcessManager.dll
- Size 25KB
- SHA256 f0ccf4d380918c939ec13b668e6b643ad040375411d71ba595efef89c4ab4241
- MD5 334f660aa6c9a8512936d6807f4d7fdf
- SHA1 b6379306cb3ae92ac5dc9de8efc499450f873250
- SHA512 7a7876dde0af2eb9df3490a1413301dfd18b1d054ccee22ecb8e8148ded4320a7615d42049e0820e428c75715d19cedfb72f697eb81777c5c242ac6f3ecf1004
- SSDEEP 384:d1y3xGUfJC71mIT33T9OZNA8z/CguRvDPNHdseXGW2OZDWl9UZUQDBMqhuF2koH/:d1y3gSC4IL3BS/UvDPllUFYslgL
- TLSH
  T162B23A056F88E777DABC077AA86353184774C1B66502EF8B5CC824F26B077C91A147DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ThirdRAT-123/ThirdRAT/Plugins/Recovery.dll
- Size 263KB
- SHA256 74151fb0d84198cd8ff13fb12c0d1a94abbdbeba79f61f4f2f1446cab24b8658
- MD5 27f9c259f84819ea64fc7ad385790315
- SHA1 cc3d3d45886197d53bd1461289e87dc8895fb30d
- SHA512 9b5c329910649671b5b2c97917ede24557e385d77cc46780a51111980fa7dbe8bc970a464bae3a814b2fde9fc6700b12391fe5cfa6f13f99d030a26ab7e1eaec
- SSDEEP 6144:JMM3t/cdcR1KcBitApmdHJxnVuGGCGxg0yyXTTE9pn:BZRJBitCmdHJxVMK0yEE9V
- TLSH
  T1A944122923AD9516F7BE4DF9947A0420877772537F20DA470FC5E18E4A32B934720B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  costura.dll
- Size 4KB
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH
  T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  messagepacklib.dll
- Size 15KB
- SHA256 554baf35f287e506dfae1c02ba34a3173b562844e5edf0a5e6a88ac07826e572
- MD5 a2d93983e4578aa5a43d4b47902a6d4f
- SHA1 a4f50a6d6b4058a9e549989d013665d15d4d8073
- SHA512 890ce6764e329e6e182872d3177aaa3b0e3055125dfaedb884bebb2574966ecf9f22a23347e1e2d76aaf98dfc61f851eb24a59c1c5bcf05306540bc4a6f3ffad
- SSDEEP 384:DmZ3HB+JII+nlmIuDG9+6tDLtMT1QZjb2Au:6Z3HPRUIuy8WXuRAu
- TLSH
  T1A262F7095B689737DBAC077DA89B03404734D9717402FB1E1CE490F26E2B7DF1A62ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32