General

  • Target
    rats.zip
  • Size 6.1MB
  • Sample260913-gzdsbssfla
  • SHA256 f95fb9f3787981a2b4f3dd22badc13f0a32230da02d926abc5fe902c6050d984
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • DLL Hijacking vulnerability 2 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • rats.zip
    .zip 6.1MB
  • HTCTL32.DLL
    .dll 320KB
  • NSM.LIC
    257B
  • NSM.ini
    6KB
  • PCICHEK.DLL
    .dll 18KB
  • PCICL32.DLL
    .dll 3.6MB
  • TCCTL32.DLL
    .dll 387KB
  • branding.dll
    .dll 50KB
  • client32.exe
    .exe 117KB
  • client32.ini
    722B
  • hw.dll
    .dll 1.6MB
  • msvcr100.dll
    .dll 755KB
  • nkageh/NationalFlag.db
    .png 19KB
  • nkageh/avutil-59.dll
    .dll 1006KB
  • nkageh/libopus-0.dll
    .dll 408KB
  • nkageh/libwinpthread-1.dll
    .dll 54KB
  • nkajko/NationalFlag.db
    .png 19KB
  • nkajko/avutil-59.dll
    .dll 1006KB
  • nkajko/libopus-0.dll
    .dll 408KB
  • nkajko/libwinpthread-1.dll
    .dll 54KB
  • nskbfltr.inf
    328B
  • pcicapi.dll
    .dll 32KB
  • remcmdstub.exe
    .exe 75KB
  • sfevfa/NationalFlag.db
    .png 19KB
  • sfevfa/avutil-59.dll
    .dll 1006KB
  • sfevfa/libopus-0.dll
    .dll 408KB
  • sfevfa/libwinpthread-1.dll
    .dll 54KB
  • tailji/NationalFlag.db
    .png 19KB
  • tailji/avutil-59.dll
    .dll 1006KB
  • tailji/libopus-0.dll
    .dll 408KB
  • tailji/libwinpthread-1.dll
    .dll 54KB
  • taivfa/NationalFlag.db
    .png 19KB
  • taivfa/avutil-59.dll
    .dll 1006KB
  • taivfa/libopus-0.dll
    .dll 408KB
  • taivfa/libwinpthread-1.dll
    .dll 54KB

rats.zip

  • SHA256 f95fb9f3787981a2b4f3dd22badc13f0a32230da02d926abc5fe902c6050d984
  • MD5 SHA1 SHA512 SSDEEP TLSH