6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0 | Triage™

Login
Reports

Overview

overview

9

Static

static

3

rat.exe

windows11-21h2-x64

9

Resubmissions

02/08/2026, 03:43

260802-d96z3stemc9

02/08/2026, 03:40

260802-d8hk4atejd9

02/08/2026, 03:39

260802-d72btatdqh9

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 227KB
Sample260802-d72btatdqh
SHA256 6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0
MD5 652728a30606900657c00b30103c881c
SHA1 20c3c9e16e79372734b48b15300ad9b77d3082ed
SHA512 4d69c51667d6dce170b2e6b3d718d35be8361ea54ccb84dbd780144a4f7572dfe2cddfa32157e5997c0f0df5ddab7ab7894857482be52718ddb392dc28026864
SSDEEP 3072:Lpi3g6BaFKesUif3AshS2FqVEvM7UFkbLT7lckOXROYHAlUSZsW:Aw1KesJ3Asx4IFHAlUSZsW
TLSH
T17F34172B77970CFCC623C07A82A6D7716431F8240324AE6F5794DB336E61D945FAB928
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

rat.exe

Resource

win11-20260513-en

windows11-21h2-x64

8 signatures

150 seconds

defense_evasion persistence

Malware Config

Targets

- Target
  rat.exe
- Size 227KB
- SHA256 6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0
- MD5 652728a30606900657c00b30103c881c
- SHA1 20c3c9e16e79372734b48b15300ad9b77d3082ed
- SHA512 4d69c51667d6dce170b2e6b3d718d35be8361ea54ccb84dbd780144a4f7572dfe2cddfa32157e5997c0f0df5ddab7ab7894857482be52718ddb392dc28026864
- SSDEEP 3072:Lpi3g6BaFKesUif3AshS2FqVEvM7UFkbLT7lckOXROYHAlUSZsW:Aw1KesJ3Asx4IFHAlUSZsW
- TLSH
  T17F34172B77970CFCC623C07A82A6D7716431F8240324AE6F5794DB336E61D945FAB928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionpersistence

© 2018-2026

Terms | Privacy