Kernel RAT.rar
- SHA256 41755d1326d7ab8d9226c33922215a7b6038105a4357472929c331ab1df830ae
Password
Fahad9374
Overview
overview
10Static
static
10Kernel RAT...la.dll
windows10-2004-x64
1Kernel RAT...la.dll
windows11-ltsc_2024-x64
1Kernel RAT...NC.dll
windows10-2004-x64
1Kernel RAT...NC.dll
windows11-ltsc_2024-x64
1Kernel RAT...fo.dll
windows10-2004-x64
1Kernel RAT...fo.dll
windows11-ltsc_2024-x64
1Kernel RAT...ll.dll
windows10-2004-x64
1Kernel RAT...ll.dll
windows11-ltsc_2024-x64
1Kernel RAT...er.dll
windows10-2004-x64
1Kernel RAT...er.dll
windows11-ltsc_2024-x64
1Kernel RAT...er.dll
windows10-2004-x64
1Kernel RAT...er.dll
windows11-ltsc_2024-x64
1Kernel RAT...ps.dll
windows10-2004-x64
1Kernel RAT...ps.dll
windows11-ltsc_2024-x64
1Kernel RAT...ry.dll
windows10-2004-x64
1Kernel RAT...ry.dll
windows11-ltsc_2024-x64
1Kernel RAT...ne.dll
windows10-2004-x64
1Kernel RAT...ne.dll
windows11-ltsc_2024-x64
1Kernel RAT...ll.dll
windows10-2004-x64
1Kernel RAT...ll.dll
windows11-ltsc_2024-x64
1Kernel RAT...sk.dll
windows10-2004-x64
1Kernel RAT...sk.dll
windows11-ltsc_2024-x64
1Kernel RAT...me.dll
windows10-2004-x64
1Kernel RAT...me.dll
windows11-ltsc_2024-x64
1Kernel RAT...ep.dll
windows10-2004-x64
1Kernel RAT...ep.dll
windows11-ltsc_2024-x64
1Kernel RAT...ey.dll
windows10-2004-x64
1Kernel RAT...ey.dll
windows11-ltsc_2024-x64
1Kernel RAT...ms.dll
windows10-2004-x64
1Kernel RAT...ms.dll
windows11-ltsc_2024-x64
1Kernel RAT...re.dll
windows10-2004-x64
1Kernel RAT...re.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
Kernel RAT/Plugins/FileZilla.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kernel RAT/Plugins/FileZilla.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Kernel RAT/Plugins/HVNC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Kernel RAT/Plugins/HVNC.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Kernel RAT/Plugins/Info.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Kernel RAT/Plugins/Info.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Kernel RAT/Plugins/Install.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Kernel RAT/Plugins/Install.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Kernel RAT/Plugins/InternetExplorer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Kernel RAT/Plugins/InternetExplorer.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Kernel RAT/Plugins/Keylogger.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Kernel RAT/Plugins/Keylogger.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Kernel RAT/Plugins/Maps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Kernel RAT/Plugins/Maps.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Kernel RAT/Plugins/Memory.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Kernel RAT/Plugins/Memory.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Kernel RAT/Plugins/Microphone.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Kernel RAT/Plugins/Microphone.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Kernel RAT/Plugins/NetInstall.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Kernel RAT/Plugins/NetInstall.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Kernel RAT/Plugins/Ngrok-Disk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Kernel RAT/Plugins/Ngrok-Disk.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Kernel RAT/Plugins/Pastime.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Kernel RAT/Plugins/Pastime.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Kernel RAT/Plugins/PreventSleep.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Kernel RAT/Plugins/PreventSleep.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Kernel RAT/Plugins/ProduKey.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Kernel RAT/Plugins/ProduKey.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Kernel RAT/Plugins/Programs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Kernel RAT/Plugins/Programs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Kernel RAT/Plugins/Ransomware.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Kernel RAT/Plugins/Ransomware.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Kernel RAT.rar
- Size 27.3MB
- Sample260827-ktmptssbnd
- SHA256 41755d1326d7ab8d9226c33922215a7b6038105a4357472929c331ab1df830ae
- MD5 0d07b2ecf7fd14b690add52b8cd5abeb
- SHA1 1997075728a68ff0e3af7444aa7f6cd9c9bf6a16
- SHA512 13c6a5b66e2fca5b12182f8007d7a10f889c5cc2a79803353800d483a357ba295aa7a90a8851313536fc750add78563690272efa827e8af742ea548af7251cf3
- SSDEEP 786432:m3hlCEFgMpUWHdTBT8QxSDZ4hKZH4a5Pvm:m3hlxFgMpUWHdGkSqYZHs
- TLSH T1D9573314ECA046AE3CD0E8C401C6E7DE9FB991B2C46714962F6268CC7F7D607E3D169A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
umbral
Version
-
v1.0
C2
-
https://discord.com/api/webhooks/1541963781620367462/kkidFTrC55cfmZIGlwnzoZSaQc2D8NECaB1wMB7TSVb0h6_BYfs72Qz1CQluoj3q5v5E
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/Kernel RAT/Plugins/DisableWD.dll disable_win_def - Detects Umbral payload 2 IoCs
resource yara_rule static1/unpack001/Kernel RAT/Builder.exe family_umbral static1/unpack001/Kernel RAT/Builder.exe family_umbral_obfuscated - Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Kernel RAT/Plugins/ProduKey.dll Nirsoft - Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Kernel RAT/Guna.UI2.dll agile_net - Unsigned PE 58 IoCs
Checks for missing Authenticode signature.
resource unpack001/Kernel RAT/Builder.exe unpack001/Kernel RAT/FastColoredTextBox.dll unpack001/Kernel RAT/GMap.NET.Core.dll unpack001/Kernel RAT/GMap.NET.WindowsForms.dll unpack001/Kernel RAT/Guna.UI2.dll unpack001/Kernel RAT/IconExtractor.dll unpack001/Kernel RAT/KernelRAT.exe unpack001/Kernel RAT/Plugins/7zip.dll unpack001/Kernel RAT/Plugins/ACTWindows.dll unpack001/Kernel RAT/Plugins/All-In-One.dll unpack001/Kernel RAT/Plugins/AskUAC.dll unpack001/Kernel RAT/Plugins/BSOD.dll unpack001/Kernel RAT/Plugins/BlankScreen.dll unpack001/Kernel RAT/Plugins/Bookmarks.dll unpack001/Kernel RAT/Plugins/Bot.dll unpack001/Kernel RAT/Plugins/Chat.dll unpack001/Kernel RAT/Plugins/Chromium.dll unpack001/Kernel RAT/Plugins/Clipboard.dll unpack001/Kernel RAT/Plugins/Clipper.dll unpack001/Kernel RAT/Plugins/Cmstp-Bypass.dll unpack001/Kernel RAT/Plugins/Computerdefaults.dll unpack001/Kernel RAT/Plugins/DeletePoints.dll unpack001/Kernel RAT/Plugins/DicordTokens.dll unpack001/Kernel RAT/Plugins/DisableWD.dll unpack001/Kernel RAT/Plugins/Email.dll unpack001/Kernel RAT/Plugins/Encoder.dll unpack001/Kernel RAT/Plugins/FileSeacher.dll unpack001/Kernel RAT/Plugins/FileZilla.dll unpack001/Kernel RAT/Plugins/HVNC.dll unpack001/Kernel RAT/Plugins/Info.dll unpack001/Kernel RAT/Plugins/Install.dll unpack001/Kernel RAT/Plugins/InternetExplorer.dll unpack001/Kernel RAT/Plugins/Keylogger.dll unpack001/Kernel RAT/Plugins/Maps.dll unpack001/Kernel RAT/Plugins/Memory.dll unpack001/Kernel RAT/Plugins/Microphone.dll unpack001/Kernel RAT/Plugins/NetInstall.dll unpack001/Kernel RAT/Plugins/Ngrok-Disk.dll unpack001/Kernel RAT/Plugins/Pastime.dll unpack001/Kernel RAT/Plugins/PreventSleep.dll unpack001/Kernel RAT/Plugins/ProduKey.dll unpack001/Kernel RAT/Plugins/Programs.dll unpack001/Kernel RAT/Plugins/Ransomware.dll unpack001/Kernel RAT/Plugins/RunPE.dll unpack001/Kernel RAT/Plugins/Script.dll unpack001/Kernel RAT/Plugins/System.Management.Automation.dll unpack001/Kernel RAT/Plugins/TCPGET.dll unpack001/Kernel RAT/Plugins/UACBypass.dll unpack001/Kernel RAT/Plugins/Update.dll unpack001/Kernel RAT/Plugins/VB.dll unpack001/Kernel RAT/Plugins/WDExclusion.dll unpack001/Kernel RAT/Plugins/WSound.dll unpack001/Kernel RAT/Plugins/Wallpaper.dll unpack001/Kernel RAT/Plugins/WebCam.dll unpack001/Kernel RAT/Plugins/WifiKeys.dll unpack001/Kernel RAT/Plugins/Worm.dll unpack001/Kernel RAT/Plugins/uninstall.dll unpack001/Kernel RAT/dnlib.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Kernel RAT/Plugins/System.Net.Http.dll
File Explorer
-
Kernel RAT.rar.rar 27.3MB
-
Kernel RAT/Builder.exe.exe 229KB
-
Kernel RAT/FastColoredTextBox.dll.dll 333KB
-
Kernel RAT/Fixer.bat122B
-
Kernel RAT/GMap.NET.Core.dll.dll 2.9MB
-
Kernel RAT/GMap.NET.WindowsForms.dll.dll 147KB
-
Kernel RAT/GeoIP.dat1.2MB
-
Kernel RAT/Guna.UI2.dll.dll 2.1MB
-
Kernel RAT/IconExtractor.dll.dll 10KB
-
Kernel RAT/Intro.wav35KB
-
Kernel RAT/KernelRAT.exe.exe 8.8MB
-
Kernel RAT/NAudio.dll.dll 502KB
-
Kernel RAT/Plugins/7zip.dll.dll 1.3MB
-
Kernel RAT/Plugins/ACTWindows.dll.dll 10KB
-
Kernel RAT/Plugins/All-In-One.dll.dll 4.8MB
-
Kernel RAT/Plugins/AskUAC.dll.dll 9KB
-
Kernel RAT/Plugins/BSOD.dll.dll 8KB
-
Kernel RAT/Plugins/BlankScreen.dll.dll 9KB
-
Kernel RAT/Plugins/Bookmarks.dll.dll 28KB
-
Kernel RAT/Plugins/Bot.dll.dll 10KB
-
Kernel RAT/Plugins/Chat.dll.dll 18KB
-
Kernel RAT/Plugins/Chromium.dll.dll 25KB
-
Kernel RAT/Plugins/Clipboard.dll.dll 9KB
-
Kernel RAT/Plugins/Clipper.dll.dll 10KB
-
Kernel RAT/Plugins/Cmstp-Bypass.dll.dll 11KB
-
Kernel RAT/Plugins/Computerdefaults.dll.dll 10KB
-
Kernel RAT/Plugins/DeletePoints.dll.dll 9KB
-
Kernel RAT/Plugins/DicordTokens.dll.dll 6KB
-
Kernel RAT/Plugins/DisableWD.dll.dll 13KB
-
Kernel RAT/Plugins/Email.dll.dll 4.6MB
-
Kernel RAT/Plugins/Encoder.dll.dll 11KB
-
Kernel RAT/Plugins/FileSeacher.dll.dll 644KB
-
Kernel RAT/Plugins/FileZilla.dll.dll 5KB
-
Kernel RAT/Plugins/HVNC.dll.dll 53KB
-
Kernel RAT/Plugins/Info.dll.dll 18KB
-
Kernel RAT/Plugins/Install.dll.dll 10KB
-
Kernel RAT/Plugins/InternetExplorer.dll.dll 11KB
-
Kernel RAT/Plugins/Keylogger.dll.dll 12KB
-
Kernel RAT/Plugins/Maps.dll.dll 15KB
-
Kernel RAT/Plugins/Memory.dll.dll 8KB
-
Kernel RAT/Plugins/Microphone.dll.dll 539KB
-
Kernel RAT/Plugins/NetInstall.dll.dll 9KB
-
Kernel RAT/Plugins/Ngrok-Disk.dll.dll 7.0MB
-
Kernel RAT/Plugins/Pastime.dll.dll 17KB
-
Kernel RAT/Plugins/PreventSleep.dll.dll 8KB
-
Kernel RAT/Plugins/ProduKey.dll.dll 98KB
-
Kernel RAT/Plugins/Programs.dll.dll 9KB
-
Kernel RAT/Plugins/Ransomware.dll.dll 19KB
-
Kernel RAT/Plugins/RunPE.dll.dll 11KB
-
Kernel RAT/Plugins/Script.dll.dll 9KB
-
Kernel RAT/Plugins/System.Management.Automation.dll.dll 2.9MB
-
Kernel RAT/Plugins/System.Net.Http.dll.dll 176KB
-
Kernel RAT/Plugins/TCPGET.dll.dll 11KB
-
Kernel RAT/Plugins/UACBypass.dll.dll 17KB
-
Kernel RAT/Plugins/Update.dll.dll 11KB
-
Kernel RAT/Plugins/VB.dll.dll 10KB
-
Kernel RAT/Plugins/WDExclusion.dll.dll 10KB
-
Kernel RAT/Plugins/WSound.dll.dll 539KB
-
Kernel RAT/Plugins/Wallpaper.dll.dll 8KB
-
Kernel RAT/Plugins/WebCam.dll.dll 209KB
-
Kernel RAT/Plugins/WifiKeys.dll.dll 10KB
-
Kernel RAT/Plugins/Worm.dll.dll 13KB
-
Kernel RAT/Plugins/uninstall.dll.dll 11KB
-
Kernel RAT/dnlib.dll.dll 1.1MB
Kernel RAT/Builder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 997d41660fbd88a4b282ea21b2fe5f82baa6cce6aac7adee9cb450991c577ebc
- MD5 f49dfc7ab132be059bef8182d0129cf4
- SHA1 87602b6c504808a8de573c5e99e4e80c88befe98
- SHA512 9b513cbce90901136bf43c1fab7368be86bd0e361f0b799979b78c8d1ee9814ab7d6b218b749c795a1eb267a97849da55efb98f19eccc9f044401632986ff8e2
- SSDEEP 6144:/loZnybCQeWNNjth7gDz3ah/SobxM8KDXqBVa07nIr3Tuuuxp8eFJLsc:9oZLpWHjAa/SoVM8KDXqBVa07nIrQJp
- TLSH T1A0346C5527BCCF16E65F9FBDD5B0148F8772F103E90AF78E0D8899E81812B01E849A97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
240350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Fixer.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
Kernel RAT/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Kernel RAT/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84199a22c8669a39800272c3da0d969ec4e8d77d67b9d324ca049953a5042c71
- MD5 d65fd6dbbd3c9ac74139aeaedc4a5816
- SHA1 407ae10ccc8e19798bf75cb90b2150cb63a9db66
- SHA512 b8a99e88d49a6f9ff89339fa5acc9df8b59665d2ec22ccb4741e501bba6b280b00336906a637d8f071f86a4dcd68ca4ac86683e651466f084cb96d0e3152eddf
- SSDEEP 49152:ClU6fD73waJnBA5lV8jldVmIgA5iKOvhn:ClU6vznglEldVmIJi/vt
- TLSH T12DA58E4CFFC3869DED59D6F06E57222E4936C09071A7FB00A6AD6B398C9D3310B162E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
2220854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham\source\repos\Guna.UI2\Guna.UI2\bin\Release\Secured\Guna.UI2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Intro.wav
- SHA256 16efb695f04b5c43d2ca8dece299207f9604d5d2c6acce191b815fcd8da26b42
- MD5 6b6271087be2800ca142f5b6ac02c975
- SHA1 ccf7f5f4883f96039cf48c93f4aa2ad722611a0b
- SHA512 1de7a489cb8dc036eca853970f0512bad9a4c70f58241c39521a5a35a09493ce435f3256d510c6fe68a970c37d7384158af02e1e6f0ffbd2d960b74b3c1d086d
- SSDEEP 768:8SGwBef6KRdaznh0/8AjraO9Tmyb2mezqt5NlnOg7vB9Slj:8SGcef5a7h0/X1TX2/OXPn/O
- TLSH T1B9F2E1B12A9CD719C87C29B410081638B7561D30E7BE11DAC3A8D47377ADC1CAB6EEC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Kernel RAT/KernelRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 04914e59c03816c24370ac258ece7007bac36d6175c1a5b60cf68c0365b2d2b2
- MD5 b42b8996835eec0cba00abd2d34c448e
- SHA1 a67c19513d672eac0af56069c8a151ad865c2215
- SHA512 d5a1915fa641c63d4bd66d14414204981cdea47c0742dae0b8ca223ee8b0a961df9e073eba0b05f9ae80ff454ca653501d0b89a7578fe6f2f649ebacbe02aa41
- SSDEEP 98304:ZDV2f3ZKUiJC/OxgNSOUH21DOMXhM60IKNwHZTTTTTTdHPPrcpGuFq0Qm3GWLqOY:SZKUiM/U5BiDOMF05NcPPgGcZ3GWuO6
- TLSH T184969C033392D624D87946F10852DBB04261AD5CAE298BF636E87EBF7BF11C679543C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Fahad9374
Minor OS version
0
Major OS version
4
Entry point
9232654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
Fahad9374
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/7zip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac45f954a9d1e918ae7f78b3b11274d00a0b07d7aac22ef7c691f3adc56f781a
- MD5 0b188d59e7b10d3c088bad64de044370
- SHA1 d5f96b6340d7e86a04c1520cd0ed4865abc6d8c8
- SHA512 5c5f0ad0c46f98ec32cca0d3b2acd567212678e41c59a79c10873cc9cedf8cf652a61e5bdf9cdb7bdc15736a73bd78e65252e3c51737b74f1a44af7bbe96d489
- SSDEEP 24576:z0/LsiV9P+XbiDmHzsvTK6BN2TBQLge+ErnuIAr24sNhHXZ:zcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHX
- TLSH T198558D15BBF1C078CA8A46318A2DABB550F9E71FCE1058C727C0AE6E6F31CD5D225A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1338038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/ACTWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2eb4052edbb4ab611e3ba9d8bca13c16ecf2f15735c067f6166b72405941aa27
- MD5 e868c10d267e8f5daa0b22e6976f072f
- SHA1 e9b542466b950132e53f43db1a451d19e43e4cb5
- SHA512 4e4d35beb5cbdcda55072e22c7784d47f19e97be24c022e2d1802d4b2117f033b4f133cd0ee1bb8cb00519e5e60bec4f97afb4705c04285b95a7f7e0c58ebc3c
- SSDEEP 192:V29alCi98OgSwNxyPlaMrp5O+Rx71tvTkIW1PnZLFzSTSQMLuOF:V/lCi987HyNHrpw+5tvTunZxzMSQOF
- TLSH T10222096957E08335CDFB0AB3585397510774CA08D913FB6F18D8B046EDA326987E2729
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c18920567a2d3dac836237ba0eadacbb620930551c5163ff601eee4492dce6a8
- MD5 04fbd2a90b7176826202cd66e83e02d5
- SHA1 c69d79a54ec8df46a08cc9a5abdb443e74a5b8f8
- SHA512 6028caf661bea06b2abf4437b55469754e9215821cedac5e1472d3858c1204a4fbd29660f618cdb34fc0e88ff620e94cfdc3ed0a8c09b8068e01cefcaa24b7d6
- SSDEEP 98304:LP19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtdk:h9FPRkC8C9OH7c2ilInz0kfVo26Wsd
- TLSH T13F3623186BE18617E5EF97F0D1A2424A97F4E057E35AE79F5E8484FA38C2300DD222D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5042582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/AskUAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8862ef216fcf1ac876420ca1c10aa40d6d87a2f13c92e47b79a5f2323e39db4c
- MD5 460f11f444b4c74db325d06aeca71a29
- SHA1 11af11fad0e5e43639d6caec6c0deea7ce4a133f
- SHA512 be970c0e392dd76761a1dcbfc6c7c389c51f250183e07c5f80ee949214b6d9e704ca39421f2e2e1705964b47d86f9076bf184f370014ed91484c8ea4a176f6af
- SSDEEP 192:LHUtgZzv/vcimeeGOp8bzJgyBTkIW1Pn/KisawMLW0A:LH6gZDc/ebc8bWyBTun/KHakt
- TLSH T17A12F82553EC8371C87E0EB64CA3222107B5D704CE63EB6F59D0A0664DA7296CAB377D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/BSOD.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8edee317aa202f38ed8247bdec7605651e52a80bcbaf7290c2ab05a9302f241f
- MD5 eb056aa9d5b8a244ea3e1abcf5d57c05
- SHA1 07a0ff1ce3905defd5b059c2c27866a7d05064fb
- SHA512 9ca5c1e46d72b86673102cfd1c1679d3fc75edec92fe919bc41c29920c82929b1ef40912f88edfee71a41bd32d6eebcb0b5f8aa805a559adf35ffdc44b4068ac
- SSDEEP 192:EzyjeIJFb81/aFUe7IGOqs1ZT0IW1vneil2GGAFTL29:EmjeIJtFUeFUZTUneitGAw9
- TLSH T16902F92597D483B6C4AB0B729CA3525107B6D600DA63FF3F59D0B1224DE35858BF2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/BlankScreen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c7445d9328ce3e0cc8517b22b0911f515068b0c3fd01e3eb0a0bf8bff32e5e3b
- MD5 bc6fc5a4e393eb00f33c5cb5797250fb
- SHA1 41c4ddceb7776de66ff21587f42a61da91a23152
- SHA512 80c54a4c996db71f884d15d10a663bf051dea1571a1cbc55f26e6fd1018a3ed46370aa203e8db50349d98475f09036f9fbd86412abf679bf0d1d6669858068fa
- SSDEEP 192:TzfcER2CRuTzi9fTGOlF1LATWEIW1PnaJwpM4QLOzu:/cG2cS+UTWOnaJwpMCzu
- TLSH T12612E62F93E082B5D86B0B72DCA396110B70DE10899B7B6F44E5B107C8F75944BA2F38
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Bookmarks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 33e92be602a8d1977912747715b722f797dd0e925755e426632206c04bb8e753
- MD5 983ca0a60bb3914c2ae8b82e4cc3d799
- SHA1 fbd878cd03fd402a1c2dca19d12766b344a95350
- SHA512 3f7facb6ed1106c8f777778141d7a02169c5d6ff156b3e2ba58bb798845ea4b2a0bff9021efd3bd65ff7fa5c1ba8ef47b3b9c3e3cb0c89493cb68e5833c7ca7f
- SSDEEP 768:Vs/yGRoX8l3E0edaVUdKFK713KccHaUibsw1z9regq02GkYC7B9gB:R82dR71EaUib7regq02GklB9gB
- TLSH T11ED2EA0C6BE99237DDAD977970E3112407719229B903F76E0FD8E9642C77361CA036AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Bot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ae60448928f93b9bed4de7bb4ca6b1746d3c9813d6764e8fb043fadf41f0914e
- MD5 6c8faab008290467f96c2e7f5ad83159
- SHA1 70b849132ae2314d69c08aa9065e35d13cbbbd57
- SHA512 d2389d613ccb4d9e7b09ee462332dffdba6b73c47be0bb467a0ac95b233d47bc2184b23db4f785770f86b76d837c9c849742d5e6af318c5525cd7cac715889f6
- SSDEEP 192:tnmuXhgnBQrPh6xXGO6e5TgycT4IW1U9y/L2lEWMLWB:drhgnBU6xWjoEycTt9y/L2lEGB
- TLSH T198220A2957E04276D9BF0F720C7292120776DB048C13EF6F19C861499E6B3598FF2A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aeb5bb9ec956a32b99e43b3d738fe06d1605244b399b223f4c36744df252210a
- MD5 f8848b8cb8dd4ce160b46d4e30e2b399
- SHA1 63d65e46aceaecb5bec9967522d50fbc7364d177
- SHA512 35004314d65a962a95fb5d885141a9c0e4fbf61a12352e3ef5589611b24d1fff77efb6dfbbae347fb3521c76343f5c14c75d54d4926c7d53ddc3a2c94e0f2d9d
- SSDEEP 384:IlYxU2S30UL7xkm3ePgfFLILcaTKQt0InoIWfUUW7fB:IZ2S30UXx5eofFLAcyqIWfUX9
- TLSH T10A822B29A7E28372C3FE6FB65C72928643F1D211CA03EF3B5EDCF0AA4A872514251755
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1ac15859d8ef0586527a02d180a766e813e21cd0ffc78c4dd885441af51e6ff2
- MD5 534ee83a8fc2ac43058686629c58a309
- SHA1 54e553fc44526c425ba8b33ff6ba9c3de5acd620
- SHA512 2a99edfbac27d2514c3a7740e322710eb978429a0e5208bf403fab2feb95a2af47d2e13008e1c8176e183337879ca3d17d5e50136267a24a9c5481d74fce0e01
- SSDEEP 384:DtGWc3ht3Xa7LHDxtN59V/PBPugcO/cnjqlg91YDa3Zs2kSx7:pGWcR5XeLTRP1/6qCbYW3ZsFq
- TLSH T108B229096BE8C204FDFF4EBA84F607108375B0973E22E79D86C2905A5A71FD49412BD3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ce10494c9eed1b75f4c782369d21edaa34639063022767af67a76b68c11654a0
- MD5 a2407f1ca13c6c4a1626f97ca8d9a91a
- SHA1 dd337a8e8a085713b6283c4d5e905ae782e0f50e
- SHA512 cbec6c1887427f949e3db4c9b5078fbfdcb6c49e3fe7488139d14608dbef21532561da1efbe2fc80753c60ecf5c14c10cd0c1ca9acf60df708eae92f0ae7c6a8
- SSDEEP 192:5Pii8UcvhpOQds1TLxIW1Pn/Ll7RML2rU:5Z8UcbrqTLbn/LlNrU
- TLSH T10612E76597D8423AC8EB0AB75DA392C007B8E314DF66FB7A5CC0B0154DA32614FA2F25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c1e26dcb242ff0eac5bfae0006dc4f1ce3f2df4cd7e0af998987561ffbd72d3
- MD5 9db27616706c2ee276de2f7a9db3a3a8
- SHA1 8975ce07a0cfa542b1c9cc3a4c87b530e27afa92
- SHA512 f0b5518af91ed60a4725bc4a064048b6da84419d16fa7de2f1149bf7b0ca83d93eda2b90f927391a2a97ac439787302da85a54bac29983dd196a893c30e3903e
- SSDEEP 192:tfxgo6FiR3r9UdNltsOIO/dQ1GiMIW1Pbe/DQPA8/YjNMLOf:tCFar+dN/IEuGiWi/DQPA8/8Hf
- TLSH T112221B11D7D982B2CCAE4F3E58B3535107F5E748D967EF2F18D8B0429CA335987A2A21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75c8669fa26a3528d0b7f65ff2763a20226f582bc33421df525f7511e7eca5d3
- MD5 a18713ce8011c5b33aba16df55978fff
- SHA1 0de4b63f8705bd4be5d594f9ea487f60eac5951f
- SHA512 12a70a757ae09798a09d38648fb0fb765750c59a956969f84fde76afcb114b122987c2ac86614c851729787ddc5cc292a381fe0e336ad7d30a166f76311debe7
- SSDEEP 192:VZcVJH7Z1m+Vn8kPWwuv5YTqPgGO2XWbAaugyaTcIW1vr/DTEaliys7GuJYATLuK:M/7ZAuaiqJBXWbXpyaTir/35liysvJYR
- TLSH T1EA32D7157BD48274E6FA0E729FB2D2120B76FA089D27EB2D15C4A00A087F605CBB1B75
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Computerdefaults.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37a7db2be0c5a038679c6e414ed5cdd7e7e8efb410412137633464d61906c20d
- MD5 187363bf276223d442d72f67326ae144
- SHA1 820eb2fdaf06d0022d8849c123c0f7ccb08a2f54
- SHA512 98288e947031026b3b3950065f173d422eb166b30d978a62469323db97d5b6948ad51a2f5a693af0461c721eefc7ff24a93ff5bc26c1a2382481ee56aeff11f5
- SSDEEP 192:uy3eljoEikzHGOinDgyITjIW1PD/lf5lrljlQ0lIdlUdSxEFocTLuM:uy6riCmb0yITND/lf7iGofM
- TLSH T18122F96967E48138DA7E0E726C72A20107B5FF058C23FF2F06D4A25548B3258C7B1B79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/DeletePoints.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 191ea7a90bd9182b033ff1a9f3240fbb03439247f2ea88dede07731f54047895
- MD5 977be99949869c849c260c60193a91b2
- SHA1 97cc24c1bf2b0d70a3b7575302850d3dffc3e4d0
- SHA512 3be3829a5216b2922bdee2fd2eec0c9fb0835491f685e3d7fcf9f8bcac440de892b37770191d854bc733475f13aa6029ec6bf494bcbd7a59e61b1431d86f0cb5
- SSDEEP 192:fIhxzJoUYMqYzB2FCTCGO70140TwIW12nH7Q7eVMLuW:fIhxKUY9Yz9DxXTZnHk7enW
- TLSH T1B912E96653E0837DC9AE0B737CA313610B72EA04DD57EB2E48D0E01A9CB75158BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/DicordTokens.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7c4fcc8469cf5f294bf37419c27c1e9272b4fad47b236671fc1f273a609f06eb
- MD5 bedaf60c4ec69272621d2bc74a58afe1
- SHA1 03eefca5698dea73011dc39539884f119f769daa
- SHA512 dcba337c901751d83400b48bc093502c02674e65da77550bceb39b41cd307da1e6aade9c2532d31c93b13d06f23e49f1e4884a5d1433a01c129bd269fb329e3d
- SSDEEP 48:6BbV/BvVV5VydE/tjIaVvNXOu5RKgS8PCtcUl8nNMAcx3numn2sex05x0R+HmliF:OBpVydE/9Fiwvx6tcUlrA0v0R+mldJ
- TLSH T16AC18219ABE4CAB9EEBF0E309DB251010374F658EC67DB4F4994924D2D366584E31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12018
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/DisableWD.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d0c6f5d916933a1f8d852ca42163ff50bfe07132fcacac03db7d20f573284208
- MD5 e4f5af68ab62a442a5dcb6ce0e3d86c2
- SHA1 09b4710ae76437b1ade0309eb19c0667ac625e51
- SHA512 b3ec580c8bfa843261bf6f6ff1afaf90e48ab328d3d6daf2aeab2a93de523627e811816bf75725f04982c056acddc46cc06d252469fd9920a104f3275e52cf41
- SSDEEP 192:TQLEv8T4LLpNkQvmDbeNEDTRQmCkUE2WKU1GO0zb7lgJ1T9IW1Un/3eKtfxie9yf:TojqEdJUEDtw9zbyJ1TMn/3euQ4XbU
- TLSH T17B52E94173E85278F5FB5F35AAB221154A37FD09DC22DE6E15A4A00E4873A44CEA2F36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Email.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7df1e95e047c0bf7350e57103717fd42186730dfd1d71c111b26e99c604432d5
- MD5 9b0adc89a6d80f498bb4c3e5a12d70ed
- SHA1 5124ba1d3916580dd86a056f96840672831c1fbd
- SHA512 67be17b77787b151f0a46176b266954fd7b1c6afd3e5b70e47bd9fdcb277c1cec68bea51d2e3d1818d3f86f772fa6aef036cb5795f7dc0748610299885f644dc
- SSDEEP 98304:LR1dWdFt15LrL3sO59meXDZu1Byz9nXvOs9H9wF9QOIkChiDC9OtH7c2iwGx:rsFtvvsO59jDZ6SLwFPIkC8C9OH7c2il
- TLSH T1162623192FE0C22BE19F57F1C6A7065947F5F096B29BFB8EA984D0FC1D423415A222D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4851318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Encoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ed36110989eb114814f3fda75511266b7781f1670d98e5355c5c6ada57628bc4
- MD5 7b3032ea7858aead0969f0c704f2d76b
- SHA1 c06fdb577e60d93dd56d09b00d47b422a5705f20
- SHA512 7b4248c01fb1afbf35393f9b1b3835a4327f9f532a632d3a45f4691b258e99a544e8043f38a92c4968438330f22309e89a13d7374f522abeb0d2779f23888769
- SSDEEP 192:6gv9Y4KofL4k6Ppll8dld5efBGOzutx1b+T+IW1PnQ7SiipjzH/L2aN:nv9woj4RsrPefMCuVqTAnQipjz66
- TLSH T12832092E67D08672C9BF4A724C73C64107B4DE048953BF3B18D2B14A5E776850BE2E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/FileSeacher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 668e6229189059a813aa0f164b4b456001ab64f574f979d73681c4ab09e7d31f
- MD5 2aaca1c9c7abcf972af16cd894f7c916
- SHA1 aacd7e374e3ab1b237f376c5f98780ea034314fb
- SHA512 6ec1d14233e4d6f42374b123222c821f908b187d75a542f9e43900752b19c02f6a1764df0086fcc05ecf6c0505be6f3d5561a0e6591d8cb257eab1baecfa06bb
- SSDEEP 12288:WuFi6nimeK3ZQPS4Ys50ie6CfqgsmE0aKZ6Eic:Xm64YNVvGmRaKZnv
- TLSH T16FE47C102BE8C65BF1BF67B2D0B25A619BB4E446F61AFB8F5C8420ED185370099117BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
665094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
642KB
Virtual Size
641KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/FileZilla.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d5792dda7add7693bb69b4249a2b7e0290d0eaf1ff0fb3c37756472fc131c756
- MD5 0240f9239bd1b0c6760693f8f4d5c411
- SHA1 f6dcb2593938a0197083d1c33639a13424923fea
- SHA512 2c5e1941ba6be118845b879a33b2336a3ba95fc4b04834efa84991cc2c541165ca4b752dff9157bd1a7499d6178af2ab8f7aaadf679d3c6ac85f5fc750e7dd89
- SSDEEP 48:6gNaQUyYIXFNvi9pTKSC8SKZhmJSvAwYNMQMQDoB6Nu707pI5s6jWxhi4EXtnSlG:HUy1vaZSKZhmJSvvwZDo4i07XmW3tTA
- TLSH T18CC1A50573E88736DEFB8F31ACB651401277F6499A26D7AD1CC8B1D93C367244A31E91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 35780226b4880e6a5eb8384389bb964cbeb9d5805da8930bfd60140250dc8310
- MD5 49a0f10008f669a165c5108032b28aa5
- SHA1 aed970e703195930ecc1b58ded3e8a24db5b79da
- SHA512 29dcd418988f4d89f8b415eed4450f246273315d836d49afe41bc693503e159f962074345b751b43d2285f3eba7c6a2fd3cf977098a21120acf3663aad5e78b3
- SSDEEP 1536:gTWLsCnSIYDUTFm8Lq8rYYtGvAcRsAWYS:7sKFDu80YQv3Kb/
- TLSH T14033E13D03D8517ACCAD18B259B368A243F0CF6549D7DF3F10E895E66CA72821D22B79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Info.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 01c3c5b20fe9ef6b36c8c1a2309701c261a6e79795763dd3605c4d35de7f3a82
- MD5 f4a1183c8c48c5793897982d70c96592
- SHA1 9867812f100dd4a3733bf720fced6ae8b02a0069
- SHA512 7432948f95985eafcf20baafa7032dd7523e529d7d277c8a6e2490c63f590ab8cd4cf90ba877af1a24d74117332929e993dff7648910e0db97c689a3acb98bd6
- SSDEEP 192:O7l9vOGnAMvnvHvZvfX+czvhvvWDxmvWLsdGObl/ev18qb4rIW1CNN69TdU6fb8p:O9A4Xl0DxmvWjclyR4INNid24pibd
- TLSH T11F820810B7E41678D6FE1FB64872915006B7F607CE27DE2F5DD8506A4A73388CE90BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Install.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57850762773eba7b931c4332129fbbb0f70723ce95ad65394167bf64118eb71a
- MD5 03b3e454ba6d8dcf9ce71396b1f33189
- SHA1 b2ccf6d5c3c01485636aa3b7f3b8437057fc734a
- SHA512 d7d3883ef41b54a3bbfd4f23c97704d5cb21d9aa655aeaf9d0230ed46bef5660278df261607c114258dc9fa635d272c1938246dd10f3066e3514a915b2eaafb5
- SSDEEP 192:FJklM7qtTCjqZIyn2a8Z8GKGOiba41hbBIW1UM/uUua9nxDTLWM:FJsM0TCWZIyDW8G3XbxhbYM/99nxCM
- TLSH T18A220B11ABD08275C87E0B769C6356014772EA07CD33FB3F99D8A1195C6326587B1AB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/InternetExplorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ed53a432f2b41b02d2ec537e2525a5777f344e76b69f4f960d58935ffcea64a3
- MD5 4c4bd6d79ab3dc5f410e8872a07da8f2
- SHA1 75526702c1240c39705f237eebb05002479a00d1
- SHA512 ab5156e92d9a0ff5dbfe42f23c9447bed982152b5406b87f7a3e4203a3e9ee7935af52b73071bbf9b192416b6df451dc8b70536eef4e0ca0c3f16b4801e29985
- SSDEEP 192:GR20Qi1MkDqmTOd9pSCjseiNfzQE16JA+Bn1PmxwTjfUp3:GR12eqmTOpjseiN/16JdBCqMV
- TLSH T1E732C609A7E88225E1BF877A9EF343261234F922F932CB1F09E559091E73F514295F39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 32726f49ccc890ebc79c9c67776fc21e50f3a893ebb688c01b48b7e2f3355712
- MD5 8c733decb0af2791ee341f67af5c232f
- SHA1 2c0a890ae30e8fb3e721c332b6547447ee31017c
- SHA512 470c8ba4392bad8cc32529d90f042eb3f6711c5593b827ccb707d994bfe357d02223dea2c3bc05296df492ae76a753f9197efdc1e8ac90929390f14e8028c56c
- SSDEEP 192:mF4XvgURnvMyEUUCkbf3HW7hf55GObFLHF1Bw6x6IW1m6Vh6p7RYioNcHnxML250:mFeI45kbfGl+uLzW6cVh6xRg4550
- TLSH T101422865A7D4827ED8BD0AB20C6393541772E3018F23FF6E0DD9B0064D776A887A197B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e569c4cd975b944c9364d6764a42f8ea774c57fe7a8c772f5206953fb046155b
- MD5 0616b13386e66dd5d28629e862cd597b
- SHA1 6465a7190dd037ad4b4f9fc12586f03b4505cf3f
- SHA512 5b0a838358b8c8e28041f51d830abaa1d1773df4b9fb4bf508e2a3fb5aae39edc5abff9a395992c2916a8a612b2edae1dd301dc9deb0e85763998edb7c32aa14
- SSDEEP 192:d4/n3oEIh6IkFJ1usnxid/sWeqVXnXoFhN56gVte31HCKM6IW14X/b84Im3t2mLS:sngcIeiHwPRteFiKsX/b9tQo2
- TLSH T194621B16A3E4C272D6FE0FB35C72A24407B5EA05CD07FF2D65DC506A4A67B92CE60722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5424ee284b8113046d630170d6631d1c46a930776dfbabcbb725bf604906ce00
- MD5 e0a69f11f6f84e145ca0003385e766a1
- SHA1 2768d63f8d4799d6872bf536a57510c55511beae
- SHA512 9ee6694749da7d2192dc1d6e878d67a16db55e562fc6126ea3df8d263393c1f766e28c1431f8dc9e4039bc84699239155a1bd3ecab017607c1b0db808415753d
- SSDEEP 192:Ep14DC2HwQG8A1OQGOz714uOIW1fn/kK+QMLun2:EpuC2Hwv444uen/kK+Qn2
- TLSH T1F902D4214BD48375D9BF0E729CA286110775E600DEA7EF3E8DC0A1274CA36958FA3A35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14642
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20c743c08e2d639dac6797bd516cc414340efdbcf6e221ca931c88f9c6af7531
- MD5 2c5219443503a4e57fad632a54704da9
- SHA1 ded7040567527ae13b72ba27ecde100076924964
- SHA512 ea6c7677ae9fcc28231c8700916938dfb98bb398fdc1f1cdf33f1b57c5128cfc54841bb4805107e6b7106c4164af5774d5b0d75560bbeb9447cc69a7289c4b64
- SSDEEP 12288:lcHij8LgXvwMZEvBgbgBqGvxDhnP1Mhu:aHipXvF2vKbgB7vxpG
- TLSH T1D1C45D11BBD45527E1AF3372B0E20F2E6BB4E48AB326EB8F045087E85E937455C41B97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558466
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/NetInstall.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c37dcb20b0e446d3b38050cc8516a7209817c5b3316b6caa4d54f358eb395c69
- MD5 125b7e01a3303a35b0e2d2f670b579a0
- SHA1 8304949ba27b8aea4eb46c47249ab9e4a3e92e24
- SHA512 235a34bf5e1929ccc357fe2cfe04c1807327c33b2d84925ce4d05a64ee2d6035274ffb04b46d02fed1c9959d070bc43561ebe245cc25cd8275d08730776b0881
- SSDEEP 192:FZEH4AlvcsVPBGOUVigysxeIW1PnQ9u0fATLOzSY:FZRAlHOlPysxAnQ9u0fTzSY
- TLSH T170120A2897D04335D9BE1A726C635241067AEE00CD27EBBF49D8B12B4DB32158BA2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Ngrok-Disk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8161d4b6e29df6e30067d1aee90c73e11b0b7f1ecc659f26ae0547b2828ad2d9
- MD5 406e3d652a07191675cfa3b80e3a4fee
- SHA1 fffdc96aa086895be98082bc837ce6d396f97d7e
- SHA512 34d7f88628a73abd616e2472c5a4880bdfa3a5ec413bacc70cddb06b401c5c2bb054fdb4a678290f66aa187d2b5b8e6dcdec813e168847986a56ce31e21aa0a3
- SSDEEP 196608:jCsxED7kwTV6B/nCR7+AA3e5MryK5Rj1Bpw7Vdjz8wEO+Dl:jTED7/VEqt/A3TryARj1BpwLktl
- TLSH T16D7633286BD49267F7EF57F1CD92014A0BF46027B29AE7CE2DDA48FE1DC23049921197
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7368606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7369af008b7198d30d059b4a16da8161f0c4bc7dd11536e4c5ec8d8a39d5275f
- MD5 40200a4aee55a0764f3b38140e887383
- SHA1 0cf1fc8fc87e6be4cd1a63bd3fdde81ac6b7d267
- SHA512 567bf11019e3cf864f030ebb65d0226df1f108ad774fe3f948d9ed8b286e8838b5a9f2bd01a99d135528ceca545f498e046230779a05ece6b221124e94dfc6b2
- SSDEEP 384:g5mSVHqDK8mm265Q1yMFUeS+Us1jhtIvOia/mT+//YjVJsA8/VHMIU:bSVHqDK8WyUhS+LVYFy/weA8/VHw
- TLSH T115821A156FE58371CDBD1DF20CB3A31903B5E2059E23FF1E56D8605ABD73A818610B99
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/PreventSleep.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bb73a0150fb0583f82a59ca9eb7cb6cc87553003702837c01473a846cfc66743
- MD5 25292baa60e00faecb650c3aa2fc86b5
- SHA1 b6dd1c1bac5471b9b5e371728cc8f24f2a0da97f
- SHA512 b604f122ca14b97f5727994a832a9b8dbc6f6faa26d1a3d9ac937103f66bb9fb4eed451ce3a231c138eb2fe526fe1926308643d5a5a3565f353af66e8dd2b74f
- SSDEEP 192:NbA4MnX0GOwav19TvIW1Pn/sp4jTH/LuA:NFyX1ot9TJn/sp4jeA
- TLSH T11202E93193D4C276D86A0BF61CA3A2510779E600CA63EB6F59D4F0165CF31944BF2A75
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/ProduKey.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 15010f1b02c583735b038a3a84816472a2cd247263942921750a2e7639f0ccca
- MD5 920fa0170cde818fd27b63f2df463558
- SHA1 54ad4d12d05b030da89cf349aa52484d5aaac3ce
- SHA512 1f3318372832083f9ec343a6b72b867cc87ee9f05d629f0d9c9171497b49181083d50b629144b3b56f9c71b900dd9e5d34459d5786b29abc566b01774578efb3
- SSDEEP 1536:ny9+7bgISAwsbzcvesvH29p9coCgSeX06hfKRXso2G9eUJxDbi/:nyI7b/SQ3cmsCXcovdX1TG9eU7o
- TLSH T186A37B437BE04471D9E60A702AB69F318EF1BC215539CA1FA758A98F6CF1380CE2535B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5218a0a992d243dc4b65b957107f1fa86388f350778e5598a5cc72cc2c4a252
- MD5 862eb1121320649071b3bf0b1fa83154
- SHA1 2f2a21bfb7d28839eebb6e487da9e0a8a7469dbf
- SHA512 162e06b9d7be082cbf37619ca71e912752bee3476810e20547da1ae7f25dbeeea2e1c2ff659dcc4c252fd632dd705f2c677c828c7bf1e8c1cbb8b21935c11ea8
- SSDEEP 192:OFEF1iICi952GPdbRGOEg1WTkIW1Pn/S+mkVRzMLWcb:OFE6ICO2Mx8mWTun/S+hVR3cb
- TLSH T12C12E72657E8C271D57B0A32582256400A39EA048D2BEF6F25CDF11F48B77598BF2B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3474d551ff6d6b213d3cd3514530826dcc69539af51ff3cdaeafbf5eebe86c10
- MD5 fd08582b27385aa79953958a8c9a24cc
- SHA1 7d6668df5d8c63d278ff07815196c7e5b560ffea
- SHA512 0e5ad6b78bb4afae732232bc39ad1da521aa340094a6a859533ba5980c908317ee33498c37425f1c81542a2b8c58d208b8e06ae417994f57d67ff6b5d550202f
- SSDEEP 384:22Ke2Etr8SLzINyKU9kbbxXfB+ZMmoI+sHT4k7MoeLZtHeh:22eECS3INzIk3xXP879ws
- TLSH T15092072E63E4E134DCFF09F360B392500371CD366821BA297DCDF06A1FB21994296D66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 beb2f498ae6c0901026c285807d4985aa3b64be486764010f73835fa17efa039
- MD5 30a43fa3bddc5d72e3e8616312fa1fc4
- SHA1 65c1920c1a199f951fe4b9f5d542049b3cd1d3fd
- SHA512 9b681ba0796e747c47a0b029e6f8a8d9093b5da6719e8652981edbffddeecc9531b91062a85c2e50e1b126e5412c289392cd1555b23c4eb319fe5afa30e09aad
- SSDEEP 192:exlFfqh94qT5rmUrm1eNGOJeq1JQSnIW1fUst++8po7MLuw:exlFChWqT5rm57kJQGUst18podw
- TLSH T11E320B2D93D48279C8AE0AF34CB313811B76DB488D5BEF3F54D4A4171CE32958AA1771
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Script.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 801c33e87bd3b80c27f94446428959afba8575c1a9d8c8b83c0d0a19486e6823
- MD5 eac192aa2555cc3e129c04d362923138
- SHA1 41febef9ef9a4ebef4fc411a62a05b7b0ac621b0
- SHA512 4188bb5f3e159fcf3fd842aeac1b27e49872ca55212d13c70d837507388b7a63a52b4c8fae670648580de5703dfb648ddb65226a2bed5b5927dd5f4e364a074d
- SSDEEP 192:a6E66cRsuGOgEu1iTcIW1Pk/3/FRML2z:aN66EsLDRiTGk/vFZz
- TLSH T13512E82697E48271C5BF1B361CA396010F79EA04CD53EB2E5AC4B1169CA725C8EB3B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/System.Net.Http.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d566e051fb3e4bab4553945a5f611ae931d9f8a56b426168abad3ed458da492
- MD5 28ab7abe312cd7dcec9c5390a9548db3
- SHA1 d2dc0c583e406e344cfbe4f39abe8222351929c3
- SHA512 c193acfcc33846ae1a68bc0b3fa5a42099d3f7c3c6916a678d0f1ed960d9953ec7001d8e74a5812953cef5f8e648f91785b4355a161c0e2235410bb4b52d2373
- SSDEEP 3072:gcLbBPuoDvWLLot2fbhTWhISam5fGBDyNAFZbRfAY/EROUv8M8Z8:gcRn6HVdOISaMfuQvD
- TLSH T143047C1527FC865BF3EF473DE03516118B75F6856503E7AE5C84A0FE28A3B90CA212A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 9, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
180046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Dev\WebStack\External\System.Net.Http\obj\Release\System.Net.Http.pdb
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/TCPGET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4ff01ca94eb2aa3cf2dd1216cfd55e2a97b9bc72ba3f71711d0e5359a065c5a1
- MD5 fb923b9f1e26be97bb065cb3b761462a
- SHA1 349ed1e5f581fce1182be43ef575803ee0ebcfd4
- SHA512 0589497d195e4ae0c4def2437a01b0da1751868812e24127df1be8a1946f3773e25564f71d08a96610408ee33f57ad70429bae5eed2ef383b09ab94e2eb4a813
- SSDEEP 192:PQ9oodFUBEGh3/PMxPb1GRO1F00Y1HoLIW12z/tD0jIgNQLO0C:PQXkBEOMxPb14AwHoUz/t0jIgP0C
- TLSH T14B320969D7A4833ACFAD4B720CE3A2021779D702DA177F6B10DC70156D6725D8B92F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b480d3bb99cfa7fd147fd1d69d03f6ad705f6e9f3fc1ef55ce39a0c781242d1
- MD5 f7524da30eee432b96d32d2267cce783
- SHA1 aeeacc39f16cd8e34f23e2a152230a9b4c60797b
- SHA512 d33035cbcb36c07d920a7f4ae7812b3e1b78a19842314d000200782401d7082ff5320d88fa8aa3b22e7e194e521e8cae1bc5728427ea64f2bb7fd3837520b3e3
- SSDEEP 384:A2Pog5dG+EsaT8yViF3sVSEY9WzlrBFKJWpk59509P80z:wcQtmsVlY9aj49sPF
- TLSH T131827BA9D3D88378D47C8DB65CB2620107B1D6184D67EF3B49F4B0065DB32EE4A61BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Update.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acc6b08d35c6d47a5578000b76cc9bad508e422265943542e55c4f474737a07c
- MD5 5f62f47e48e842fe59777b1120724079
- SHA1 588b792f6e5ed80e0ee71029bc0630073813809a
- SHA512 bc5ae488d720baf1a2f24c4f749349995b75f2ab5c44bc0c5490eb25d2d98456290381480c033fcff8ad95f8b72b7f5d3bb783fcf50c175a725790a94a941114
- SSDEEP 192:qob+4SrATXA0JLrX3f4cnSti6i+7otuK9GO4bhXPBMbOIW1Um0zu7urV9By2f/L:qob+brATXA0J3v4c8U+6uKYHb/Mb/mwS
- TLSH T1F2321B1EA3D48332C97E1B350862D3010775EA06EA33EF6F49C5A4594E736588FB1AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/VB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 104b620b5ea792263e82e78ac406c2b76032713d26ec182b40c835eb0f984535
- MD5 ccd19f4ca19f508fed91a4f48b6e646b
- SHA1 b61e8f433226343c60db24e765a569c5222d14ed
- SHA512 ee8646ac5982c2c11a1f4bfd232f0b9dc9a89dbc5bb1e3b41e2c82d1531ae439cbf5aa1c7cbd49da63e49d84a02af102930bb93894edf5ccc0a84dbf9d51884b
- SSDEEP 192:8saeShQZqnVVHnkhSOGOFeD01F4SPlF6IW1PnxlVoGjMLOg/:8sa7yCkhSry7F4BnxlGG9g/
- TLSH T15822092A43D48774D9AF0F329CA291122770DF04CC53FB7E2DD4614B89A36554BE2B29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/WDExclusion.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bbd4262c8821a0290fe40a8e374c6e5fa2084331670ede42e995d3d5902efcd
- MD5 5337f0fe8bb85d8454803809d2129faa
- SHA1 93c1991c32f813540c4344ef8fd6625155e6817d
- SHA512 cef7e4280a5377dea4189f31f83d7a618264d7f0999e5a7f4f9e4a0e41bfa37e1ce037e4dff60b0f7e8ee15a9d46997f0d72aaf9d17e0d61e8419aed76fcdf28
- SSDEEP 192:Zo8Q7GQqAMVR6fX69dpyaSG5SWuEEgytzZ2IW1Pn//Dn9LJ1AF6C2TL2r:ZEy/WQoWuGytzZYn/7n9Ln7C7r
- TLSH T13B22D719A7D08274CDBE1F72587282510B75AF0489A7BB6E48C8A40DDC736588EF2F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 796b812dd5048145bd8465bf58ff2ce7eb5b3179fab311eb5961a7b352e4cf56
- MD5 c718ceb04ffc7130a488c345034e5e78
- SHA1 77801fea79017c7ac6cfcd542e08e3e2e6b26648
- SHA512 fd6a60d3e437ec871d8b4bede3aa6f9ad59b1ea68d7b59bdbe528752fa6539e5f0ce63b5045a2d23d7524e057bc9df03269d4cbe0ffc1f8c02b0d606634570a4
- SSDEEP 12288:ws+RJMUTZEVLMbgMLpPxGd7x+IQzyu5H:LOJMUTZEVgbgMNPod7xNju1
- TLSH T1C1C46D11BBD09527C26F3772E0E20B2B57B0E4CAB36AEB4F05A087A95DD37525C40B97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Wallpaper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e14608284bf25ae71d2c750ebb914378c4b8d8d04c0bde0794163e883339270
- MD5 169275398ed21481f51fa462c3ea9370
- SHA1 4c87a733ff9e5c9901b54c20acf555481f0e6a2b
- SHA512 a953e1e33fc9619a5bf167cf83baf6d8f30a93e3059f5791f071270f18ea9f32b98e4eff2f07b163f365982503325d57ca7ec03760193f80fc759192d7cb4421
- SSDEEP 192:7zE77g1dXfcGOhl1ST8IW1Pd//PRE63N/LOhU:7Q7k1dXf9sSTmd//PRE63EhU
- TLSH T14B021A665BD08379C8AA0F725CB282510B74EB08D957FB6F59C0A01A4CF32564FE3B79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a8903ac8b4014897a4445de031abf11b8b566b7402a03d45eec5f4cbb3c7b3f6
- MD5 943e10f013633cdd3de111caff86dd18
- SHA1 c60a1a003da434e35b864bf75f4d3863bbd53611
- SHA512 e275a2f7a7605799796692475f30f929fc963d35789ddb687e270e905587b783bc97cb2e65388c02da0b2f5cd696e500cb0f50430ed13f9803f1de5924ffd351
- SSDEEP 3072:Z1WR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZ9o:Z1+22fFcgBgakL320zYZHpMXM/5W
- TLSH T1A8247D06B3E58076D5BE4A3588735A599B79F8118B71DF9F1B94026E0F633C08E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
219670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/WifiKeys.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f06b851585e23b98ef790b28e40f483f3284d57a379b667c7e1286d570f4de5
- MD5 cdb5867ecfa299aafa316dea392745e2
- SHA1 47ec4d999a9ac5d0a44d1196b1715f0bc070e36c
- SHA512 14e927132a4bb015214419917bbd06a5a5c2ba8ed058b14d47785b7be5f57998ed532127f2caac98d98cc336d05c8c13eb66ddff6175a2abe464fc413d41d396
- SSDEEP 192:oLQI82LNcAuRGOdu11iTCIW1Pk+bsqGOXYuTLu8eOrre:oE2Ncl8CmiT0k+YxOXYR8L
- TLSH T15122D61663D48376DDFE0F32AC62971007B6DE08EC23EB3E59D4B2954CA31548BE2761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15962
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b8ffef55e9f920496c8877bc60ed8d0d7028e84507e3bb41be73b16ae29a1d05
- MD5 7026ba664d7df39eb2699caa9309ce75
- SHA1 db0d6e10b2ddfe5d48c062643b79842bf055b43b
- SHA512 bb01bb7025189d7182d29fbe3af2110648924f74d2c9959ac82663bc37dd1d5bd245596f0be230278aaae1ac9d09da6df7ee536728aa386ce5ddf5575f50c6f8
- SSDEEP 192:nPpwOCkKdPfS0GcHUuaYUrULqJINGOr0JBrokrIW1PMGU/SIannlraaIMLODX:nLziPfS0U/YhLqzLbsk1MGfnnlWa4DX
- TLSH T16D52195943E88639CB7F0F724951616007B2EE09C863EB6C45C4B19E5BB36808FB1E3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/Plugins/uninstall.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8faf00f59c16b481bb3b4e0f9113c9a1e2048f317f1d168acbc8b308d6b8cf0
- MD5 80f53a48e589c1ed377444dd4009d7ab
- SHA1 c35bea3071c69f6df44691c96f435ee215adfd7e
- SHA512 4a01b52eef719c7772bdce57a84bef55a59ebd081785459def015f0097ed0e31533ae069508286fc71ce56a2c09232584c2b596ba417d3944813c327deaa7b1f
- SSDEEP 192:NQUvWv7vq8fVZC6HzlqP1GOcbhdPBfbjIW1Um0zHcLV47y/LWuk:NQUvWv7vqWVJsYvbtfbOmwHa47huk
- TLSH T10632191A97D08236C9AE1B715862460207F1DB02E963FF1F09C4A459AEB33184FF1FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Kernel RAT/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8bc7a627149386cb3cf714ae0101f69440f72cf2e7468a677b727b32aaed755
- MD5 9ed69fbbfdec5d95ea229da3969dd77b
- SHA1 7972339f0a1b6a28a2f335c84cdfc5d9beee72b6
- SHA512 61bfaa00736487ed736a27c1a9e45ce14b578452471866d195ce1a4736e72bd4bec98938b8cbb83ffbf09cbf188e9b8760452cc95ee30565414882aadd0171a6
- SSDEEP 24576:+9itfCdSZYeP0jsLpPl44znxuhv7fBTu1Z:W5QF6
- TLSH T103355B0177E8DB37C19F977B9422082847F1D896A7A7FB5F5A14ABA92C87740CC412B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1162638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net35\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ