rats.zip
- SHA256 f95fb9f3787981a2b4f3dd22badc13f0a32230da02d926abc5fe902c6050d984
Overview
overview
10Static
static
5HTCTL32.dll
windows10-2004-x64
3HTCTL32.dll
windows11-ltsc_2024-x64
3PCICHEK.dll
windows10-2004-x64
3PCICHEK.dll
windows11-ltsc_2024-x64
3PCICL32.dll
windows10-2004-x64
3PCICL32.dll
windows11-ltsc_2024-x64
3TCCTL32.dll
windows10-2004-x64
3TCCTL32.dll
windows11-ltsc_2024-x64
3branding.dll
windows10-2004-x64
1branding.dll
windows11-ltsc_2024-x64
1client32.exe
windows10-2004-x64
10client32.exe
windows11-ltsc_2024-x64
10hw.dll
windows10-2004-x64
3hw.dll
windows11-ltsc_2024-x64
3msvcr100.dll
windows10-2004-x64
3msvcr100.dll
windows11-ltsc_2024-x64
3nkageh/avutil-59.dll
windows10-2004-x64
1nkageh/avutil-59.dll
windows11-ltsc_2024-x64
1nkageh/libopus-0.dll
windows10-2004-x64
1nkageh/libopus-0.dll
windows11-ltsc_2024-x64
1nkageh/lib...-1.dll
windows10-2004-x64
1nkageh/lib...-1.dll
windows11-ltsc_2024-x64
1nkajko/avutil-59.dll
windows10-2004-x64
1nkajko/avutil-59.dll
windows11-ltsc_2024-x64
1nkajko/libopus-0.dll
windows10-2004-x64
1nkajko/libopus-0.dll
windows11-ltsc_2024-x64
1nkajko/lib...-1.dll
windows10-2004-x64
1nkajko/lib...-1.dll
windows11-ltsc_2024-x64
1pcicapi.dll
windows10-2004-x64
3pcicapi.dll
windows11-ltsc_2024-x64
3remcmdstub.exe
windows10-2004-x64
3remcmdstub.exe
windows11-ltsc_2024-x64
3Static task
static1
Behavioral task
behavioral1
Sample
HTCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
PCICHEK.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
PCICHEK.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
PCICL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
PCICL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
TCCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
TCCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
branding.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
branding.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
client32.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
client32.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
hw.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
hw.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
msvcr100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
msvcr100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
nkageh/avutil-59.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
nkageh/avutil-59.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
nkageh/libopus-0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
nkageh/libopus-0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
nkageh/libwinpthread-1.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
nkageh/libwinpthread-1.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
nkajko/avutil-59.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
nkajko/avutil-59.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
nkajko/libopus-0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
nkajko/libopus-0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
nkajko/libwinpthread-1.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
nkajko/libwinpthread-1.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
pcicapi.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
pcicapi.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
remcmdstub.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
remcmdstub.exe
Resource
win11ltsc2024-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/msvcr100.dll |
| unpack001/msvcr100.dll |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/hw.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/nkageh/avutil-59.dll |
| unpack001/nkageh/libopus-0.dll |
| unpack001/nkageh/libwinpthread-1.dll |
| unpack001/nkajko/avutil-59.dll |
| unpack001/nkajko/libopus-0.dll |
| unpack001/nkajko/libwinpthread-1.dll |
| unpack001/sfevfa/avutil-59.dll |
| unpack001/sfevfa/libopus-0.dll |
| unpack001/sfevfa/libwinpthread-1.dll |
| unpack001/tailji/avutil-59.dll |
| unpack001/tailji/libopus-0.dll |
| unpack001/tailji/libwinpthread-1.dll |
| unpack001/taivfa/avutil-59.dll |
| unpack001/taivfa/libopus-0.dll |
| unpack001/taivfa/libwinpthread-1.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/msvcr100.dll |
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=23, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=1, productName=Unmarked objects,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=122, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=1, id=152, version=20115,
count=42, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=849, id=1, productName=Unmarked objects,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=254, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=211, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=24, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Jan 8, 2025
CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Jun 11, 2024
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Jun 11, 2024
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=5, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Aug 19, 2020
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 11, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Apr 27, 2016
CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=3, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Jun 11, 2024
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Jun 11, 2024
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=86, id=170, productName=VS2010 build 30319, version=30319,
count=29, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.