rurat | f9b5f26ed9bdfff1714e2e1f3e9ce5007c3f8e5a3fef38bd165b5dc9df437aa7

General

Target
secure_privatbank_payment_09.09.2026.317256.rar
Size 28.9MB
Sample260909-js9yasbe97
SHA256 f9b5f26ed9bdfff1714e2e1f3e9ce5007c3f8e5a3fef38bd165b5dc9df437aa7
MD5 3d55bbf025ecda5b633ddff3e4a56114
SHA1 d915873aa6973e6a7982e17c3f7bcb835c57380f
SHA512 88422adc37b49d9ba67ef0e77d96d79d697c3d34ee29e91d187d113ce40925d3f9c2c5e6711eb6d9e16e7ba438574f02128d1cf9c8fb4617fd7633deead26255
SSDEEP 786432:P1X5HeQLglvq8UVRv4p/ZyXs27rN92d2RUuBwP97:9JHevS2xZ/275A0Tc97
TLSH
T1986733571AE18A9CF5BC43884A4A15139C3BBDC3E3291F7D58FE121940A586E3A1CF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  secure_privatbank_payment_09.09.2026.317256.rar
- Size 28.9MB
- SHA256 f9b5f26ed9bdfff1714e2e1f3e9ce5007c3f8e5a3fef38bd165b5dc9df437aa7
- MD5 3d55bbf025ecda5b633ddff3e4a56114
- SHA1 d915873aa6973e6a7982e17c3f7bcb835c57380f
- SHA512 88422adc37b49d9ba67ef0e77d96d79d697c3d34ee29e91d187d113ce40925d3f9c2c5e6711eb6d9e16e7ba438574f02128d1cf9c8fb4617fd7633deead26255
- SSDEEP 786432:P1X5HeQLglvq8UVRv4p/ZyXs27rN92d2RUuBwP97:9JHevS2xZ/275A0Tc97
- TLSH
  T1986733571AE18A9CF5BC43884A4A15139C3BBDC3E3291F7D58FE121940A586E3A1CF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  secure_privatbank_payment_09.09.2026.pdf.exe
- Size 28.9MB
- SHA256 7e8cb4faffde387389acd279d0a841966508839a87f4c930cb0b9b05aaac3d2d
- MD5 6a4881234c0c4baacddc314f9f835204
- SHA1 38b5c77a382341801101b86ebdae92d26be48966
- SHA512 00444ef47f8bdc040fd3e3ac5b3d3e9009777611190de6e522f51c7197bd014e936882688c5f936a4ab2ae49af86b5e3e04e3d65ba95cae26e05c53dcf20483e
- SSDEEP 393216:R68fjN5fBOGTt6IgqN7PIN5pGuSkpHPm0TfF+kH6x3IYeXHY5BpIB7XluKx06Q3c:8ahBBOgmNPm0R+PIKfIhDrIb3U5
- TLSH
  T1596733D473440585EAAF433E9A422BAE91337D328B2857DBCA08B5B24FB9D44143E7D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery rurat trojan
- Family: RuRAT
  RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
  trojan backdoor rurat
- Contacts a large (827) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral2