Overview

overview

10

Static

static

10

2026-09-13...ch.exe

windows10-2004-x64

10

2026-09-13...ch.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
  • Size 14.0MB
  • Sample260913-lte6esaa49
  • SHA256 92d1ebdc14b8aa7987e16d318dca40955491e8d0d0a88b48b0c469cd7f1c1140
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
webratratupx

Malware Config

Extracted

Family

  • webrat

Version

  • 2.0.0

C2

  • webratik.sbs:7777

  • https://webratik.sbs

  • https://arball.lat

  • https://webratik.eu.cc

  • https://webratik.lol

  • https://webratiko.eu.cc

  • https://salat.webratik.sbs

  • https://c2.webratik.sbs

  • https://ee.webratik.sbs

  • https://ge.webratik.sbs

  • https://78.17.187.5:59077

  • https://89.208.32.130:42781

  • https://89.125.120.6:62965

  • https://104.143.218.6:61870

Mutex

  • WEBR_KBFY6M96MCEW

Targets

    • Target
      2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
    • Size 14.0MB
    • SHA256 92d1ebdc14b8aa7987e16d318dca40955491e8d0d0a88b48b0c469cd7f1c1140
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    webratratupx

    • Family: WebRAT

      WebRAT is a Windows RAT written in Golang.

      ratwebrat

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables referencing many IR and analysis tools

    • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

    • Detects executables referencing virtualization MAC addresses

    • UPX dump on OEP (original entry point)

    • detects Windows exceutables potentially bypassing UAC using fodhelper.exe

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks