rurat | ba243e591b5643b65f92898bd44b3cd88a7a662c959560f097bfd367efbb4834

General

Target
Arhiv_elektronnoho_dokumenta_22.07.2026.126634.rar
Size 25.0MB
Sample260722-rxam1as1cs
SHA256 ba243e591b5643b65f92898bd44b3cd88a7a662c959560f097bfd367efbb4834
MD5 5aca28ef7d9a18a61290bcc55e59d987
SHA1 240855f27281982edd46874ad7d0016a81cbfbf8
SHA512 09e5ae9642725e9cd6476a1a63fccab94355873ce1ee007257dad993e660847d5bdec94c5cfb854efc38e4cf00aa5a421c3f06b60f2b6d123930a2133aa1e46f
SSDEEP 393216:x8MzO/gxYrvMbD+bcsJ+mYXBLEHUl82I2lzx8OcjbSBRvd6Yk1XQXwBDAEolekls:SBrvQDycS+mYRI0O2I2llc8FU0TkxtV
TLSH
T1D5473363FD9340DFAD8D3D8AA45B923BD0312C5C39C416E6A53988158DEEF9CE0D19E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Safe_privet_documet_22.07.2026.126634.rar
- Size 25.0MB
- SHA256 1f12b29da311e1db5084928a58980184bc5086b9d86d027c1ea002ffcd75f45f
- MD5 559fe32c28433e85e8f21f34bcb282c6
- SHA1 1c8664146cb8d3879a598521f9259b989840742c
- SHA512 2bdd5f91985f307746af5399c749cea5a6828682cbfb710cf522945548fb815cc91c23cc130595c2eea3ad29d44d7eebfbd485e47cd8e630228610ca9f6989ff
- SSDEEP 393216:g8MzO/gxYrvMbD+bcsJ+mYXBLEHUl82I2lzx8OcjbSBRvd6Yk1XQXwBDAEoleklV:bBrvQDycS+mYRI0O2I2llc8FU0Tkxte
- TLSH
  T131473363FD9340DFAD8D3D8AA45B923BD0312C5C39C416E6A53988158DEEF9CE0D19E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery rurat spyware trojan
- Family: RuRAT
  RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
  trojan backdoor rurat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  pass_22.07.2026.126634.txt
- Size 532B
- SHA256 ec5ac9bb47a90aadfeee72074484941c24f1dfb5e4e18ec617d1d5c4acafcd13
- MD5 941a1408c907c2efbbbe94f9f24b7d4b
- SHA1 57804325ae715e39b6c711d240e04320e4bf93ec
- SHA512 3bdfa1989e73c61787d15effbf5293ade68baf0278dd0ff439fa30e218a8b78376e3c1265163c879017d5e1fb2d253e767bfc853f46ef0b4b45e8d014093b742
- TLSH
  T12BF0C2B3222D90DA3541E46EC50066046EA7313C7371D35700987E3F23ED020C229372
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4