Extracted

• • Target
    2026-09-10_8249752fe7eb2ca3168423d96cb28f4d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 13.4MB
  • SHA256 5f05bb15be2babe22075ef2757cb9804901545e0fccc8a4df1224babef716bf2
  • MD5 8249752fe7eb2ca3168423d96cb28f4d
  • SHA1 92dae749b67b1814212633187d5ea3c054b0110d
  • SHA512 e7c5bf38f53acfca170cee718eee03809355fc350bf723ff9355eaee2316b76ed0d6b176e89ca42d973449d541a632c4f20c980bf62c342e36b0521acfeb3863
  • SSDEEP 98304:OR406bZ2Swc5yGc3tYJPUDKtOgAp7h/gt6EA8f9ARQI6cbX3wYrGzxU2+qq:aQHwc5IQPAinA8f9ARQI6cbXs9U2+
  • TLSH
    T1D9E63A87E8A545A4C0AED535C6669263BA713C8C8B3463D73F50F7382F76BD0AA79700
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwebratpersistencerattrojan

  • Family: WebRAT

    WebRAT is a Windows RAT written in Golang.

    ratwebrat
  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables referencing many IR and analysis tools

  • Custom signature

    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Custom signature

    Detects executables referencing virtualization MAC addresses

  • Custom signature

    detects Windows exceutables potentially bypassing UAC using fodhelper.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2