cornflake | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

Sharing

Copy URL Twitter E-mail

General

Target
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
Size 7.7MB
Sample260814-vnqjmseq21
SHA256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
MD5 fba867df17721879df9d8dcca68d6900
SHA1 510af9bb00ff5d4a6856b1291af55db9f6e13551
SHA512 b467c408efcb8d86fe01c90a6fdb597480dfa9da93e5f802c9ebe53679e62c52de0316fa4bf4124c85d8f78e7528903f8b93ac95e838549c04027e46f9cdf006
SSDEEP 49152:/4sfnDspRPNLTR8GPHJ6dI7CmwewbJnzZQBuK37/Vviizf0VZ/OMnz0DTPIyOj+1:/4sPgzBqCJZT0fTSrgBrsES
TLSH
T103864A07EDA555E9C4ADD2318AB691127B727C490B3027E31BA0F6243F77BE06EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt midnight_blizzard rat stealer cornflake

Malware Config

Signatures

Family: CornFlake
CornFlake is a Windows RAT and stealer written in Golang, used by Midnight Blizzard aka Storm-2945.
rat stealer cornflake

Detects CornFlake RAT 1 IoCs

apt midnight_blizzard

resource	yara_rule
sample	family_cornflake

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

File Explorer

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

.exe 7.7MB

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
MD5 fba867df17721879df9d8dcca68d6900
SHA1 510af9bb00ff5d4a6856b1291af55db9f6e13551
SHA512 b467c408efcb8d86fe01c90a6fdb597480dfa9da93e5f802c9ebe53679e62c52de0316fa4bf4124c85d8f78e7528903f8b93ac95e838549c04027e46f9cdf006
SSDEEP 49152:/4sfnDspRPNLTR8GPHJ6dI7CmwewbJnzZQBuK37/Vviizf0VZ/OMnz0DTPIyOj+1:/4sPgzBqCJZT0fTSrgBrsES
TLSH
T103864A07EDA555E9C4ADD2318AB691127B727C490B3027E31BA0F6243F77BE06EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects CornFlake RAT

apt midnight_blizzard
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

434KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

kernel32

generic