Overview

overview

10

Static

static

10

978ab56ccd...a9.exe

windows10-2004-x64

9

978ab56ccd...a9.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    978ab56ccd8dbcfa715d9f6f8b34b379da1c465232fb92a1a7e622275f85fba9
  • Size 43KB
  • Sample260810-l4n63sweng
  • SHA256 978ab56ccd8dbcfa715d9f6f8b34b379da1c465232fb92a1a7e622275f85fba9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
galaxyratdefense_evasiondiscoveryrat

Malware Config

Extracted

Family

  • galaxyrat

C2

  • 1.tcp.cpolar.cn:22131

Mutex

  • KVZWLPWX

Attributes
  • discord

    https://discord.com/api/webhooks/1479977551597142178/YL194Wap_X6EBc-8lMBD5p1d_mvgukFdgefrjz7LW-JN1vr1JUcQkB_nRNAJDOIY-ZeJ

Targets

    • Target
      978ab56ccd8dbcfa715d9f6f8b34b379da1c465232fb92a1a7e622275f85fba9
    • Size 43KB
    • SHA256 978ab56ccd8dbcfa715d9f6f8b34b379da1c465232fb92a1a7e622275f85fba9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscovery

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks