sHga3 NuptuneRAT.rar
- SHA256 ca8043db1af639e575c764b63462186866262ced91e92da83dbece8a3668f389
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
| resource | yara_rule |
|---|---|
| static1/unpack001/dll/Plugins/BlockerAntiVirus.dll | disable_win_def |
| static1/unpack001/dll/Plugins/DisableWD.dll | disable_win_def |
| resource | yara_rule |
|---|---|
| static1/unpack001/dll/Plugins/bomber.dll | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0-windows/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0-windows/DeobfuscatorTool.exe |
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0-windows/dnlib.dll |
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0/DeobfuscatorTool.exe |
| unpack001/dll/DeobfuscatorTool/bin/Debug/net10.0/dnlib.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0-windows/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0-windows/apphost.exe |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0-windows/ref/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0-windows/refint/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0/apphost.exe |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0/ref/DeobfuscatorTool.dll |
| unpack001/dll/DeobfuscatorTool/obj/Debug/net10.0/refint/DeobfuscatorTool.dll |
| unpack001/dll/FastColoredTextBox.dll |
| unpack001/dll/GMap.NET.Core.dll |
| unpack001/dll/GMap.NET.WindowsForms.dll |
| unpack001/dll/Helper.dll |
| unpack001/dll/Helper/bin/Debug/net48/Helper.dll |
| unpack001/dll/Helper/obj/Debug/net48/Helper.dll |
| unpack001/dll/IconExtractor.dll |
| unpack001/dll/NAudio.Asio.dll |
| unpack001/dll/NAudio.Core.dll |
| unpack001/dll/NAudio.Midi.dll |
| unpack001/dll/NAudio.Wasapi.dll |
| unpack001/dll/NAudio.WinForms.dll |
| unpack001/dll/NAudio.WinMM.dll |
| unpack001/dll/NAudio.dll |
| unpack001/dll/NeptuneRAT.exe |
| unpack001/dll/NeptuneRAT.exe.bak |
| unpack001/dll/NeptuneRAT_Cleaned.exe |
| unpack001/dll/Plugins/7zip.dll |
| unpack001/dll/Plugins/ACTWindows.dll |
| unpack001/dll/Plugins/AntiFormat.dll |
| unpack001/dll/Plugins/BSOD.dll |
| unpack001/dll/Plugins/BlockerAntiVirus.dll |
| unpack001/dll/Plugins/Bookmarks.dll |
| unpack001/dll/Plugins/BypassUAC.dll |
| unpack001/dll/Plugins/Chat.dll |
| unpack001/dll/Plugins/Chromium.dll |
| unpack001/dll/Plugins/Clipboard.dll |
| unpack001/dll/Plugins/Clipper.dll |
| unpack001/dll/Plugins/DeletePoints.dll |
| unpack001/dll/Plugins/DeleteSystem.dll |
| unpack001/dll/Plugins/Destry.dll |
| unpack001/dll/Plugins/DisableWD.dll |
| unpack001/dll/Plugins/DiscordTokens.dll |
| unpack001/dll/Plugins/Email.dll |
| unpack001/dll/Plugins/Encoder.dll |
| unpack001/dll/Plugins/FastColoredTextBox.dll |
| unpack001/dll/Plugins/Fun.dll |
| unpack001/dll/Plugins/GMap.NET.Core.dll |
| unpack001/dll/Plugins/GMap.NET.WindowsForms.dll |
| unpack001/dll/Plugins/HideMBR.dll |
| unpack001/dll/Plugins/IconExtractor.dll |
| unpack001/dll/Plugins/Info.dll |
| unpack001/dll/Plugins/Install.dll |
| unpack001/dll/Plugins/KillCPU.dll |
| unpack001/dll/Plugins/KillProcess.dll |
| unpack001/dll/Plugins/LockApplications.dll |
| unpack001/dll/Plugins/Maps.dll |
| unpack001/dll/Plugins/Microphone.dll |
| unpack001/dll/Plugins/NetInstall.dll |
| unpack001/dll/Plugins/PreventSleep.dll |
| unpack001/dll/Plugins/Programs.dll |
| unpack001/dll/Plugins/Ransomware.dll |
| unpack001/dll/Plugins/RatHunter.dll |
| unpack001/dll/Plugins/RequestUAC.dll |
| unpack001/dll/Plugins/Rootkit.dll |
| unpack001/dll/Plugins/ScreenRotation.dll |
| unpack001/dll/Plugins/ShowMBR.dll |
| unpack001/dll/Plugins/System.Management.Automation.dll |
| unpack001/dll/Plugins/TCPGET.dll |
| unpack001/dll/Plugins/UACBypass.dll |
| unpack001/dll/Plugins/USB.dll |
| unpack001/dll/Plugins/Update.dll |
| unpack001/dll/Plugins/VB.dll |
| unpack001/dll/Plugins/WDExclusion.dll |
| unpack001/dll/Plugins/WSound.dll |
| unpack001/dll/Plugins/Wallpaper.dll |
| unpack001/dll/Plugins/WebCam.dll |
| unpack001/dll/Plugins/Weed.dll |
| unpack001/dll/Plugins/WifiKeys.dll |
| unpack001/dll/Plugins/bomber.dll |
| unpack001/dll/Plugins/dnlib.dll |
| unpack001/dll/Plugins/uninstall.dll |
| unpack001/dll/SimpleObfuscator.dll |
| unpack001/dll/dnlib.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/dll/Guna.UI2.dll |
| unpack001/dll/Plugins/Guna.UI2.dll |
| unpack001/dll/Plugins/System.Net.Http.dll |
Feb 28, 2022
CN=Lenovo,OU=G08,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Nov 25, 2023
CN=Sobatdata Software
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Feb 18, 2025
CN=Sobatdata Software
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jul 9, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=259, version=33138,
count=182, id=261, version=33138,
count=19, id=260, version=33138,
count=2, id=253, version=34321,
count=20, id=259, version=34321,
count=18, id=260, version=34321,
count=38, id=261, version=34321,
count=7, id=257, version=33138,
count=136, id=1, productName=Unmarked objects,
count=25, id=260, version=34436,
count=1, id=258, version=34436,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.