Overview

overview

10

Static

static

10

5601e9f5e3...1b.exe

windows10-2004-x64

10

5601e9f5e3...1b.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5601e9f5e3524dbca856001514e9e5a8116ad60917ebdc8dc9c01f2fb356b81b
  • Size 10.3MB
  • Sample260910-lep23san3z
  • SHA256 5601e9f5e3524dbca856001514e9e5a8116ad60917ebdc8dc9c01f2fb356b81b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
webratdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Family

  • webrat

Version

  • 2.0.0

C2

  • webratik.sbs:7777

  • https://webratik.sbs

  • https://c2.webratik.sbs

  • https://webratik.eu.cc

  • https://www.webratik.eu.cc

  • https://c2.webratik.eu.cc

  • https://panel.webratik.eu.cc

  • https://webratiko.eu.cc

  • https://www.webratiko.eu.cc

  • https://c2.webratiko.eu.cc

  • https://panel.webratiko.eu.cc

  • https://arball.lat

  • https://www.arball.lat

  • https://c2.arball.lat

  • https://panel.arball.lat

  • https://panel.zapretdiscord.sbs

  • https://c2.zapretdiscord.sbs

  • https://87.58.213.163

  • https://212.119.42.4:48390

  • https://89.125.120.8:55663

Mutex

  • WEBR_3P0O0JLRROEZ

Targets

    • Target
      5601e9f5e3524dbca856001514e9e5a8116ad60917ebdc8dc9c01f2fb356b81b
    • Size 10.3MB
    • SHA256 5601e9f5e3524dbca856001514e9e5a8116ad60917ebdc8dc9c01f2fb356b81b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionwebratpersistencerat

    • Family: WebRAT

      WebRAT is a Windows RAT written in Golang.

      ratwebrat

    • Looks for VirtualBox drivers on disk

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks for VMWare Tools registry key

      defense_evasion

    • Looks for VMWare drivers on disk

      defense_evasion

    • Executes dropped EXE

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks