jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430.bin
Size 23.0MB
Sample260910-3ddfbsxdjg
SHA256 1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430
MD5 bc7a671e417ce3f003780a92eacc322b
SHA1 7603b9d6d526d03ae1548d3fdaa64c48daa0153a
SHA512 df9238a32f20f22f28fc68b464a8623a09579f1577a261143f53ef758788730c303c1c44c2164b333b358a1377fa7c2d919519962793c98253e3356ad43ee61f
SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpx:q9WtLzgOTbjZvk/ekS/mcpx
TLSH
T1C037333132568472DC9211F1E9299FBBD66DAD348BB218D7A3E44F3995601C33F32A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor rat

Malware Config

Signatures

GoToResolve remote administration tool 1 IoCs

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	rat_gotoresolve

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430.bin

File Explorer

jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430.bin

.exe 23.0MB

jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430.bin

IMPHASH f8e4a22bcb1b836585534b93f63c1414
SHA256 1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430
MD5 bc7a671e417ce3f003780a92eacc322b
SHA1 7603b9d6d526d03ae1548d3fdaa64c48daa0153a
SHA512 df9238a32f20f22f28fc68b464a8623a09579f1577a261143f53ef758788730c303c1c44c2164b333b358a1377fa7c2d919519962793c98253e3356ad43ee61f
SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpx:q9WtLzgOTbjZvk/ekS/mcpx
TLSH
T1C037333132568472DC9211F1E9299FBBD66DAD348BB218D7A3E44F3995601C33F32A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

GoToResolve remote administration tool

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\rescue-native-rescueassist\rescue-native-rescueassist\build\RelWithDebInfo\GoToResolveUnattendedUpdater.pdb

ole32

StgOpenStorage

rstrtmgr

RmGetList RmEndSession RmStartSession RmRegisterResources

ntdll

RtlNtStatusToDosError NtQuerySystemInformation RtlUnwind VerSetConditionMask

shlwapi

PathIsDirectoryW PathIsDirectoryEmptyW

kernel32

FormatMessageA CreateFileW UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile LocalAlloc GetModuleHandleW SetUnhandledExceptionFilter SetLastError lstrlenW WriteFile GetVersionExW FindNextFileW GetCurrentProcess RemoveDirectoryW FindClose Sleep DeleteFileW LoadLibraryW GetProcAddress MoveFileExW FreeLibrary GetCurrentProcessId ReadFile CompareFileTime SetHandleInformation HeapFree TerminateProcess K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId OpenProcess SetFileInformationByHandle HeapAlloc GetCurrentDirectoryW DecodePointer DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW IsWow64Process GetProcessTimes LoadLibraryExW GetExitCodeProcess GetFileSizeEx LCMapStringA GetStringTypeExA GetUserDefaultLCID LoadLibraryA WaitForMultipleObjects GetThreadLocale LCIDToLocaleName GetStdHandle ProcessIdToSessionId FlushFileBuffers GetFileAttributesW GetDynamicTimeZoneInformation MultiByteToWideChar GetConsoleMode lstrcpyW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileType RaiseException AddVectoredExceptionHandler SetEvent SleepEx CreateEventW CreateThread ExitThread GetVersion LockFileEx SetEndOfFile UnlockFileEx RemoveVectoredExceptionHandler InitializeCriticalSection SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW SetFilePointerEx FindFirstFileExW GetFileTime GetSystemTimeAsFileTime OutputDebugStringW GetLocalTime EnterCriticalSection LeaveCriticalSection CreateProcessW WriteConsoleW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileAttributesW DeviceIoControl CreateDirectoryExW CopyFileExW AreFileApisANSI QueryPerformanceFrequency TlsAlloc GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent GetCPInfo CompareStringEx EncodePointer QueryPerformanceCounter GetLocaleInfoEx VerifyVersionInfoW WriteConsoleA WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete LCMapStringEx FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetConsoleOutputCP HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateEventA OpenEventA GetStringTypeW WaitForSingleObjectEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable LocalFree SetCurrentDirectoryW FindResourceW LoadResource CloseHandle LockResource lstrcatW GetLastError FormatMessageW GetModuleFileNameW GetCommandLineW SizeofResource CreateDirectoryW TlsGetValue TlsSetValue TlsFree InitializeCriticalSectionAndSpinCount GetCommandLineA WakeAllConditionVariable GetExitCodeThread SleepConditionVariableSRW

user32

FindWindowW LoadStringA wsprintfW GetWindowThreadProcessId ShowWindow AttachThreadInput BringWindowToTop

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteW

oleaut32

VariantClear

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegDeleteTreeA SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW RegDeleteKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService StartServiceW QueryServiceConfigW QueryServiceConfig2W OpenServiceW EnumServicesStatusW RegQueryInfoKeyW RegEnumValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegSetValueExW

ws2_32

WSACleanup WSAStartup gethostname WSAGetLastError

crypt32

CryptProtectData CertOpenStore CertGetNameStringW CertFindCertificateInStore CertCloseStore CertFreeCertificateContext CertDeleteCertificateFromStore

comctl32

ord345

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21.9MB

Virtual Size

21.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_1afd171c54b52110dc4156ca2a7a6abf883e4e8a84639c77070cb2b6ecea2430.bin

ole32

rstrtmgr

ntdll

shlwapi

kernel32

user32

shell32

oleaut32

advapi32

ws2_32

crypt32

comctl32

generic