megarat | 52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99

Sharing

Copy URL Twitter E-mail

General

Target
52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
Size 1.7MB
Sample260910-lepfjsan3y
SHA256 52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
MD5 35c96ce3b20df965c7a1b4140ee016e6
SHA1 daa4c3693358c3fc30a93e69c71b29eb91500954
SHA512 6809d443a777ede162fb3b7d869502b7ae49f5c9e566e5788052f73efc960c9fb232e855955aaf436b04905f452b2d62bd0bc828ab5f1f568d1a3e6f36a64190
SSDEEP 24576:ipYJZPnwGr0Ym+L5JJ0CJCTNH6FBCJgutQ/3+HpMwO5oQwIRG7A/YMFs5ovYLMty:aHGQYlF0CuNH6FkZQ2U5A7A/Yhuv
TLSH
T198858E17A3A401FCD0A7C278C9565607EBB1B4091770ABDF1AD086E66F63AE11F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat trojan megarat

Malware Config

Extracted

Family

megarat

169.58.190.196

Wallets

0x71C7656EC7ab88b098defB751B7401B5f6d8976F
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

Attributes

mega_telegram
https://api.telegram.org/bot8896309146:AAGmyTQdnLgW63YsxCG_xHfr4dDy8R47UeA/sendMessage?chat_id=8254551586
port
8080
services
api.telegram.org:443

www.geoplugin.net:80
uris
/api/loot

/api/poll

/api/register

/api/result

/api/screen
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

Signatures

Family: MegaRat
MegaRat is a Windows RAT written in C++.
rat trojan megarat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99

File Explorer

52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99

.exe 1.7MB

52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99

IMPHASH 8a083849175ee10c2c1e3f7bc869862e
SHA256 52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99
MD5 35c96ce3b20df965c7a1b4140ee016e6
SHA1 daa4c3693358c3fc30a93e69c71b29eb91500954
SHA512 6809d443a777ede162fb3b7d869502b7ae49f5c9e566e5788052f73efc960c9fb232e855955aaf436b04905f452b2d62bd0bc828ab5f1f568d1a3e6f36a64190
SSDEEP 24576:ipYJZPnwGr0Ym+L5JJ0CJCTNH6FBCJgutQ/3+HpMwO5oQwIRG7A/YMFs5ovYLMty:aHGQYlF0CuNH6FkZQ2U5A7A/Yhuv
TLSH
T198858E17A3A401FCD0A7C278C9565607EBB1B4091770ABDF1AD086E66F63AE11F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1256628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

user32

PeekMessageA SwapMouseButton SendMessageA PostMessageA PostThreadMessageA IsWindow DestroyWindow DispatchMessageA IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyState TranslateMessage VkKeyScanA GetMessageA ShowWindow LockWorkStation GetAsyncKeyState CallNextHookEx keybd_event GetSystemMetrics GetForegroundWindow GetDC ReleaseDC GetWindowTextA MessageBoxA SetCursorPos FindWindowA EnumWindows GetWindowThreadProcessId SetWindowsHookExA UnhookWindowsHookEx SystemParametersInfoA

gdi32

CreateCompatibleBitmap SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

shell32

SHGetFolderPathA ShellExecuteA

iphlpapi

SendARP

crypt32

CryptBinaryToStringA CryptStringToBinaryA CryptUnprotectData

advapi32

CreateProcessAsUserA AdjustTokenPrivileges DuplicateTokenEx CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegDeleteTreeA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumKeyA RegDeleteValueA RegCreateKeyExA RegCloseKey GetUserNameA LookupPrivilegeValueA GetTokenInformation OpenProcessToken

gdiplus

GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipAlloc

ole32

CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CLSIDFromString CoInitialize GetHGlobalFromStream

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

winmm

waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInStop waveInClose waveInOpen

avicap32

capCreateCaptureWindowA

ws2_32

closesocket connect ioctlsocket htons select socket WSAStartup inet_pton

kernel32

FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree GetModuleHandleExW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue RtlUnwindEx FlsFree FlsSetValue VirtualProtect TlsSetValue CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer WakeAllConditionVariable InitializeCriticalSectionEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteConsoleW GetLocalTime GetExitCodeThread GetCurrentThreadId DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException GetEnvironmentVariableA SetCurrentDirectoryA GetCurrentDirectoryA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileTime ReadFile SetFileAttributesA SetFileTime GetTempPathA GetVolumeInformationA Beep CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateProcessA GetThreadId OpenProcess GlobalMemoryStatusEx GetSystemInfo RtlUnwind GetTickCount64 GetModuleFileNameA GetModuleHandleA GetProcAddress GlobalAlloc GlobalSize GlobalUnlock GlobalLock LocalFree CopyFileA GetComputerNameA GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte SetConsoleCtrlHandler SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

52896134154dd284798acfed00b17a5d631a75a969661e1f9a8809e0ccbfdc99

winhttp

user32

gdi32

shell32

iphlpapi

crypt32

advapi32

gdiplus

ole32

oleaut32

bcrypt

winmm

avicap32

ws2_32

kernel32

generic