runningrat | 64[.]exe

General

Target
64.exe
Size 112KB
Sample260912-qb76pscc64
SHA256 d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f
MD5 4a88c4a8fd4ae358387fe70e97e93a1a
SHA1 e132e1b5667f14a545166dbbf91a3a53c9afcd0c
SHA512 733554dccd59585fd0d021fb94479bd9dcb4f6dce4feccc53a35f81f98a54d1d1fc0db27725f3a5129740883c8af080ca81daa8010f2b2eba2a470cba4ee5d2e
SSDEEP 1536:vqEA70HzLJksPEOajozLElnqiO2odJ/tHi:vXTLJkQ7zAV3ytC
TLSH
T109B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat runningrat

Malware Config

Extracted

Family

runningrat

C2

mm.tgoodluck.xyz

Signatures

Family: RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

RunningRat payload 1 IoCs

resource	yara_rule
sample	family_runningrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64.exe

File Explorer

64.exe

.exe 112KB

64.exe

IMPHASH 7e3107c64f6a7a76d8463e3f374f74af
SHA256 d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f
MD5 4a88c4a8fd4ae358387fe70e97e93a1a
SHA1 e132e1b5667f14a545166dbbf91a3a53c9afcd0c
SHA512 733554dccd59585fd0d021fb94479bd9dcb4f6dce4feccc53a35f81f98a54d1d1fc0db27725f3a5129740883c8af080ca81daa8010f2b2eba2a470cba4ee5d2e
SSDEEP 1536:vqEA70HzLJksPEOajozLElnqiO2odJ/tHi:vXTLJkQ7zAV3ytC
TLSH
T109B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

RunningRat payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord5714 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord815 ord459 ord561 ord825 ord743 ord800 ord537 ord1199 ord1205 ord1247 ord4129 ord5683 ord5265 ord4376 ord4853 ord4998 ord4710 ord2514 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord641 ord4234 ord1859 ord4246 ord3869 ord2127 ord2723 ord2391 ord3059 ord5102 ord5105 ord4468 ord4303 ord3350 ord5012 ord975 ord5472 ord3403 ord2880 ord2878 ord4153 ord6055 ord4077 ord1776 ord5237 ord2383 ord5284 ord2649 ord1665 ord4437 ord4428 ord796 ord554 ord529 ord402 ord674 ord807 ord2494 ord2627 ord2626 ord6000 ord2117 ord4163 ord6625 ord4457 ord5255 ord823 ord1858 ord4245 ord5101 ord2101 ord2390 ord5100 ord5104 ord4467 ord3351 ord976 ord2879 ord4152 ord2382 ord5283 ord4436 ord2445 ord4427 ord401 ord5254 ord5098 ord4620 ord1894 ord4254 ord2486 ord4015 ord4957 ord4861 ord4826 ord3187 ord4950 ord5289 ord2171 ord5020 ord4517 ord4640 ord4916 ord5002 ord4494 ord4491 ord5021 ord3106 ord4605 ord5000 ord4416 ord5090 ord5501 ord4628 ord4657 ord5752 ord4155 ord2991 ord3417 ord5025 ord3514 ord6344 ord5627 ord1003 ord3449 ord3787 ord3250 ord4697 ord3060 ord3066 ord6336 ord2510 ord2542 ord5244 ord5742 ord1747 ord5577 ord3172 ord5654 ord4423 ord4956 ord4860 ord2402 ord4387 ord3454 ord3198 ord6081 ord6175 ord3261 ord4623 ord4430 ord748 ord1206 ord2623 ord456 ord1223 ord4825 ord4614 ord4613 ord1945 ord4273 ord4589 ord4899 ord5076 ord4341 ord4349 ord4723 ord4890 ord4531 ord4545 ord4543 ord4526 ord4529 ord4524 ord4964 ord4961 ord4108 ord5240 ord5290 ord3748 ord1726 ord4432 ord560 ord813 ord5260 ord2535 ord1895 ord4958 ord3407 ord4990 ord4927 ord4932 ord4937 ord4717 ord4688 ord4857 ord5018 ord5108 ord4912 ord4646 ord4980 ord4522 ord4993 ord4537 ord5075 ord4038 ord3281 ord3353 ord4626 ord457 ord749 ord4653 ord6194 ord1886 ord4251 ord4946 ord3254 ord2441 ord1695 ord5006 ord5656 ord4470 ord5103 ord5476 ord4154 ord5285 ord736 ord739 ord450 ord439 ord442 ord747 ord5495 ord2104 ord4460 ord6064 ord5252 ord1576 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4610 ord4612 ord2437 ord4615 ord1168

msvcrt

__set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _except_handler3 memset __p__pgmptr sprintf memcpy _access strstr __CxxFrameHandler _setmbcp _mkdir _controlfp

kernel32

CloseHandle CreateFileA FreeLibrary GetTickCount GetFileAttributesA ExpandEnvironmentStringsA GetLastError GetProcAddress LoadLibraryA lstrcpyA GetCommandLineA Sleep lstrcmpiA SetThreadPriority GetCurrentThread SetPriorityClass GetCurrentProcess GetModuleHandleA GetStartupInfoA WriteFile

user32

wsprintfA EnableWindow

Name

.text

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

64.exe

mfc42

msvcrt

kernel32

user32

generic