rurat | b1d5f3dc3a8cb101fc99ac673288dc7856720c0d29a96906c0a8a3bf358367d2

General

Target
Arhiv_elektronnoho_dokumenta_22.07.2026.334452.rar
Size 25.0MB
Sample260722-lf5txsyyds
SHA256 b1d5f3dc3a8cb101fc99ac673288dc7856720c0d29a96906c0a8a3bf358367d2
MD5 0d992d058087c65e82a6ac8161101207
SHA1 8c15c82059027842c6f2049cbfd77fa4021de248
SHA512 c88445c5e6005d8c9f3eaafb08d85185fca1e18ecafa2699cd28dda0154ebde59cf1f5eeaa3f443f9775f4bafdb36cd1a7a526cfa0d70686dde07e944d669404
SSDEEP 786432:+l1r0AK+mRjPgCcspYkzoeIMppstMoGgUBD+lG:+lp0jJRTgC1BI4stwBBl
TLSH
T1A2473368EA3B3963C08F6E0407585F7A36A4A59EBB8095213B551B30FE4C45187F7CBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Arhiv_elektronnoho_dokumenta_22.07.2026.334452.rar
- Size 25.0MB
- SHA256 b1d5f3dc3a8cb101fc99ac673288dc7856720c0d29a96906c0a8a3bf358367d2
- MD5 0d992d058087c65e82a6ac8161101207
- SHA1 8c15c82059027842c6f2049cbfd77fa4021de248
- SHA512 c88445c5e6005d8c9f3eaafb08d85185fca1e18ecafa2699cd28dda0154ebde59cf1f5eeaa3f443f9775f4bafdb36cd1a7a526cfa0d70686dde07e944d669404
- SSDEEP 786432:+l1r0AK+mRjPgCcspYkzoeIMppstMoGgUBD+lG:+lp0jJRTgC1BI4stwBBl
- TLSH
  T1A2473368EA3B3963C08F6E0407585F7A36A4A59EBB8095213B551B30FE4C45187F7CBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery rurat ransomware spyware trojan
- Family: RuRAT
  RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
  trojan backdoor rurat
- Contacts a large (512) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Safe_privet_documet_22.07.2026.334452.rar
- Size 25.0MB
- SHA256 11dd71123d3e693f3939893b9da9712ce433e9b2761c6ef51ccb9331c1b8394b
- MD5 e21d6656e0669da4197f8a4b405a83c0
- SHA1 f88b0a455f9effff9d3d4b15c54b215d0b1bf836
- SHA512 c22949ff39a4f291b5c39714719533238a9b6e1701dd2a72925805f8ef1d980a29ae71968517063d918b0662b998984c000868cfe0019218f6ee0d1c7fb9acc0
- SSDEEP 786432:wl1r0AK+mRjPgCcspYkzoeIMppstMoGgUBD+lr:wlp0jJRTgC1BI4stwBBm
- TLSH
  T171473368EA3B3963C08F6E0407585F7A36A4A59EBB8095213B551B30FE4C45187F7CBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  pass_22.07.2026.334452.txt
- Size 532B
- SHA256 b643239aa6c31c5ebe54efaeeb2c8abfe80fb4e3a3c5b2b7689141eb1398a791
- MD5 f165253d7b798a6a2161ce9268abeaca
- SHA1 55a66340acc338ca53280c24d11a50745d7b7fa3
- SHA512 bc6e164ff530f17e47b3c2e64b1cc6e91a57265851c354c23bdc0d76e2ee145bfbdf0be95608887761994ce308108d5f1f366631bc073df3297cc28b96cab086
- TLSH
  T1E5F0C2B3222D90DA3546E46DC90066042DEB313C73B1D35751987D7F63ED020C329375
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6