Overview

overview

10

Static

static

10

5289613415...99.exe

windows10-2004-x64

6

5289613415...99.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
  • Size 1.7MB
  • Sample260910-lepfjsan3y
  • SHA256 52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
megaratdiscoveryrattrojan

Malware Config

Extracted

Family

  • megarat

C2

  • 169.58.190.196

Wallets

  • 0x71C7656EC7ab88b098defB751B7401B5f6d8976F

  • bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

Attributes
  • mega_telegram

    https://api.telegram.org/bot8896309146:AAGmyTQdnLgW63YsxCG_xHfr4dDy8R47UeA/sendMessage?chat_id=8254551586

  • port

    8080

  • services

    api.telegram.org:443

    www.geoplugin.net:80

  • uris

    /api/loot

    /api/poll

    /api/register

    /api/result

    /api/screen

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

Targets

    • Target
      52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
    • Size 1.7MB
    • SHA256 52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks