Overview

overview

7

Static

static

3

notRAT/Win...Ui.exe

windows11-21h2-x64

7

Resubmissions

18/08/2026, 14:24

260818-rq24nstepf7

18/08/2026, 14:19

260818-rncq1avwfx7

Sharing

Copy URL Twitter E-mail

General

  • Target
    2.zip
  • Size 66.1MB
  • Sample260818-rq24nstepf
  • SHA256 47ff97ace6e1350e211f1aeb14f0785dd43ba9cde333ab882818bea2c8714979
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistencepyinstaller

Malware Config

Targets

    • Target
      notRAT/WindowsUpdateUi.exe
    • Size 66.6MB
    • SHA256 5cb2e30800b17a029dfcdb6301a99aa0aa50b08f69bac199dac753a5c942455f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecutionpersistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks