webrat | 2026-09-11_eae660a2233dc8d00173e011697a7f08_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-11_eae660a2233dc8d00173e011697a7f08_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
Size 14.0MB
Sample260912-c8fwtsxcqa
SHA256 ed2f7ee1a3a175fbee9fa834a868826269c7f90301bdc16ab20a5a8c94029b4d
MD5 eae660a2233dc8d00173e011697a7f08
SHA1 83cad139397c6f80e1def896e74cc546efb0c03a
SHA512 ee770e02db2c2b6caba9306ae7dfbbed340f3b038de4fb4c56b61cda55238e4a3349870a676fd61f4e8574c5238daa45838f2e31dfede709ecaed36bc9d8b217
SSDEEP 98304:MlGCuHPNif9DAkEINHh5N/lR6qK6TrW5grF6BhECRLG9wYr9sB:UwcAkEINlNFokYiuLGZ
TLSH
T1A1E64B57F8A101E8C0AED535C626A263BA713C994B3463D76F50F7382F76BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx rat webrat

Malware Config

Extracted

Family

webrat

Version

2.0.0

webratik.sbs:7777
https://webratik.sbs
https://arball.lat
https://webratik.eu.cc
https://webratiko.eu.cc
https://zapretdiscord.sbs
https://salat.webratik.sbs
https://c2.webratik.sbs
https://www.arball.lat
https://www.webratik.eu.cc
https://www.webratiko.eu.cc
https://panel.zapretdiscord.sbs
https://78.17.187.5:59077
https://89.208.32.130:42781
https://89.125.120.6:62965
https://104.143.218.6:61870

Mutex

WEBR_R4R45YT45NJI6JN

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

detects Windows exceutables potentially bypassing UAC using fodhelper.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-11_eae660a2233dc8d00173e011697a7f08_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

File Explorer

2026-09-11_eae660a2233dc8d00173e011697a7f08_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

.exe 14.0MB

2026-09-11_eae660a2233dc8d00173e011697a7f08_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

SHA256 ed2f7ee1a3a175fbee9fa834a868826269c7f90301bdc16ab20a5a8c94029b4d
MD5 eae660a2233dc8d00173e011697a7f08
SHA1 83cad139397c6f80e1def896e74cc546efb0c03a
SHA512 ee770e02db2c2b6caba9306ae7dfbbed340f3b038de4fb4c56b61cda55238e4a3349870a676fd61f4e8574c5238daa45838f2e31dfede709ecaed36bc9d8b217
SSDEEP 98304:MlGCuHPNif9DAkEINHh5N/lR6qK6TrW5grF6BhECRLG9wYr9sB:UwcAkEINlNFokYiuLGZ
TLSH
T1A1E64B57F8A101E8C0AED535C626A263BA713C994B3463D76F50F7382F76BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many IR and analysis tools
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
detects Windows exceutables potentially bypassing UAC using fodhelper.exe
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths