RainbowDashRAT.rar
- SHA256 69e3cb276b867752f9fce162c971578657d906501a945992e1f9598bea9615ba
Password
1
General
- Target RainbowDashRAT.rar
- Size 21.5MB
- Sample260925-q3engaxejc
- SHA256 69e3cb276b867752f9fce162c971578657d906501a945992e1f9598bea9615ba
- MD5 4588ef5c49a9d0c08f13e8266e04f374
- SHA1 a253198da9c9f17b30fe9ba5c3dd6169cc1395eb
- SHA512 ad07f091fa77b6a0c3e9cbe1c68cc74b115d9e7e91c3cdc4c5d6ee42145060444bbf4dfe978174bba19cc22127581e51b8cce8d6e2bd4b31235e9701e408afc4
- SSDEEP 393216:CqfyEo/+F76ux0HZaIKVmm+Qw9+nXJ7CWVk3/Y3hPVr7uhleihp+Qk:n6n/+R05lKA9vRUPchleihp+T
- TLSH T1C037334410C67F2AC8F12C5417BFEC5F9AEE84A25164A88F53522085BEFFBC74B79258
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Mutex
-
BdrOtiYIs2b5sXtD
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Options.dll disable_win_def - Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/RainbowDashRAT/RainbowDashRAT/RainbowDashClient.exe family_xworm - Unsigned PE 40 IoCs
Checks for missing Authenticode signature.
resource unpack001/RainbowDashRAT/RainbowDashRAT/FastColoredTextBox.dll unpack001/RainbowDashRAT/RainbowDashRAT/GMap.NET.Core.dll unpack001/RainbowDashRAT/RainbowDashRAT/GMap.NET.WindowsForms.dll unpack001/RainbowDashRAT/RainbowDashRAT/Guna.UI2.dll unpack001/RainbowDashRAT/RainbowDashRAT/IconExtractor.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/ActiveWindows.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/All-In-One.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Chat.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Clipboard.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/FileManager.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/FileSeacher.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/HRDP.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/HVNC.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Informations.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Keylogger.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Maps.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Microphone.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Ngrok-Disk.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Options.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Pastime.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Performance.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/ProcessManager.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Programs.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Ransomware.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Recovery.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Regedit.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/RemoteDesktop.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/ReverseProxy.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/RunPE.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/ServiceManager.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/Shell.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/StartupManager.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/TCPConnections.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/UACBypass.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/VB.NET Compiler.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/WSound.dll unpack001/RainbowDashRAT/RainbowDashRAT/Plugins/WebCam.dll unpack001/RainbowDashRAT/RainbowDashRAT/Rainbow Dash RAT.exe unpack001/RainbowDashRAT/RainbowDashRAT/RainbowDashClient.exe unpack001/RainbowDashRAT/RainbowDashRAT/SimpleObfuscator.dll
File Explorer
-
RainbowDashRAT.rar.rar 21.5MB
-
RainbowDashRAT/RainbowDashRAT/Background.png.png 1.0MB
-
RainbowDashRAT/RainbowDashRAT/FastColoredTextBox.dll.dll 333KB
-
RainbowDashRAT/RainbowDashRAT/Fixer.bat124B
-
RainbowDashRAT/RainbowDashRAT/GMap.NET.Core.dll.dll 2.9MB
-
RainbowDashRAT/RainbowDashRAT/GMap.NET.WindowsForms.dll.dll 147KB
-
RainbowDashRAT/RainbowDashRAT/GeoIP.dat1.2MB
-
RainbowDashRAT/RainbowDashRAT/Guna.UI2.dll.dll 2.1MB
-
RainbowDashRAT/RainbowDashRAT/IconExtractor.dll.dll 10KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Defender_1.ico41KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Defender_2.ico41KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Music.ico49KB
-
RainbowDashRAT/RainbowDashRAT/Icons/None.ico45KB
-
RainbowDashRAT/RainbowDashRAT/Icons/OneDrive_Storage.ico110KB
-
RainbowDashRAT/RainbowDashRAT/Icons/PDF.ico48KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Photo.ico55KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Setup_1.ico53KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Setup_2.ico19KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Setup_3.ico21KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Skype.ico115KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Steam.ico264KB
-
RainbowDashRAT/RainbowDashRAT/Icons/TXT.ico45KB
-
RainbowDashRAT/RainbowDashRAT/Icons/Teams.ico106KB
-
RainbowDashRAT/RainbowDashRAT/Icons/VLC.ico71KB
-
RainbowDashRAT/RainbowDashRAT/NAudio.dll.dll 502KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/ActiveWindows.dll.dll 14KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/All-In-One.dll.dll 4.8MB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Chat.dll.dll 18KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Clipboard.dll.dll 14KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/FileManager.dll.dll 27KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/FileSeacher.dll.dll 478KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/HRDP.dll.dll 1.7MB
-
RainbowDashRAT/RainbowDashRAT/Plugins/HVNC.dll.dll 58KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Informations.dll.dll 22KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Keylogger.dll.dll 17KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Maps.dll.dll 15KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Microphone.dll.dll 540KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Ngrok-Disk.dll.dll 7.0MB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Options.dll.dll 24KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Pastime.dll.dll 17KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Performance.dll.dll 15KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/ProcessManager.dll.dll 17KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Programs.dll.dll 13KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Ransomware.dll.dll 20KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Recovery.dll.dll 496KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Regedit.dll.dll 15KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/RemoteDesktop.dll.dll 18KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/ReverseProxy.dll.dll 16KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/RunPE.dll.dll 11KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/ServiceManager.dll.dll 14KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/Shell.dll.dll 15KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/StartupManager.dll.dll 189KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/TCPConnections.dll.dll 16KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/UACBypass.dll.dll 12KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/VB.NET Compiler.dll.dll 15KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/WSound.dll.dll 539KB
-
RainbowDashRAT/RainbowDashRAT/Plugins/WebCam.dll.dll 209KB
-
RainbowDashRAT/RainbowDashRAT/Rainbow Dash RAT.exe.exe 5.3MB
-
RainbowDashRAT/RainbowDashRAT/RainbowDashClient.exe.exe 30KB
-
RainbowDashRAT/RainbowDashRAT/SimpleObfuscator.dll.dll 1.4MB
-
RainbowDashRAT/RainbowDashRAT/Sounds/Chat.wav45KB
-
RainbowDashRAT/RainbowDashRAT/Sounds/Intro.wav160KB
RainbowDashRAT/RainbowDashRAT/Background.png
- SHA256 ed989e4d272d9b76f67a2c4a80240152a82f77e5aad1310de282d51d21b4b927
- MD5 c7e0af63eb31bbac7d532f3f093b33b3
- SHA1 87ee428fb95557c421b770bc78e16957172bafc0
- SHA512 2a668bc41967e12a06a3d7f6217d524991ea8af61ed3483ec5833c051fec2ff69f3613560494a6177cace09cdd693a44e25490b432ec4f887ce6ebe7fd020326
- SSDEEP 24576:vVCOl5H0vwAYK2f0XHcrc7qs74hC+NXtE6O2+Xrn:vD0vJYK2fFrc7qs74hC+gzrn
- TLSH T12D3523D938BDF74DCFF38B2C84E230889A3A538542FF21386735286E6C59D5E56DA211
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1
RainbowDashRAT/RainbowDashRAT/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Fixer.bat
- SHA256 2c84d9f3bfbff65e12fb969cb23ebb2d2a3d99912f9a172dfbb3ed3879ffc84e
- MD5 65e992c117f7cc13865542c97f75caf5
- SHA1 62338efdf039e04d8ac790cba197565074259dc9
- SHA512 85ac9c798184ad3aa0093405af871ec6570733955c51751128d831da6a57c9ffdc8f945f1c142a94eadac52b865c5d0a0521c6bdd81d90dc35399b8c7a757075
- TLSH T1B9B02B172442D350A38005830330394538BC6002C29AD2C1B9364470CD804F0D733499
- MD5 SHA1 SHA512 TLSH
RainbowDashRAT/RainbowDashRAT/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf315ea99f64caa5e039c2b2625043f7207105ee443ec5e66796976574f24a61
- MD5 37631b0c03b4a116f217b27eaed53a4b
- SHA1 f20180d97e970d73a45440cefa354e12c7e4930e
- SHA512 bfa448e8aeb9beede313f5bad6173e8f7b0599a85be6d4eb059f926e5e060fac052785482cb5cebdaaa720c175c9a57bfcfb63ea3373a56a4480bab7b55d4c23
- SSDEEP 49152:XvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23IxjPHEiH7maFGV:Xvrqr
- TLSH T1C8A5E9186DD4EB27D16BCE33D5E25011E2F1A4933BB2EB0E62D3576C1842749788B36E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
2160574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Icons/Defender_1.ico
- SHA256 bfd615b81c80457ad04469e3044709b2f54e612e78862c924b71f73f1498d3fc
- MD5 01ffd825cfa6e624078212e603445755
- SHA1 4e6b218384c0ff3eed1c138fc8528180374177b1
- SHA512 d8aeb7f2998bb1bc3d1b1b3d8ea14c779ac14b72bfb73e5231a2f09a21165414916af626f581701865b2c44dcaa9edac098aadd64ccffff892755b308b4b0a11
- SSDEEP 96:4iH6c3wASnu9yXb8XbsP7zHNWfF8jMxCKozy6HxAFnPUKvFg:fSnu9ihW98jMkKoeWxAFDg
- TLSH T1C7139A3A55C8F36AC018667DC922BAFB68789CDCDC59406FFE813E46B831DF460B2950
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Defender_2.ico
- SHA256 645db18da91dc962999ba0745e2ebb43f69303ceee47e9f1bb3f9053ed4ef981
- MD5 59b5fdc4be311631df44e4b3bc98b3f7
- SHA1 8b3892516f0606f2972370c055a5d891884975cb
- SHA512 cf91a44ff48fe20017e7fc08ebc7e9b531a6e3aca5e360118ca6721c6cc436e6581b7a0ac875431e28b2b3d02c1938366c0c3ea3791230ad6c17f579d3b1da13
- SSDEEP 96:CdrHdDBy3tLTCtlUYIwvDWriyCW6+oOMvh5CsOjboGLmbZLxxA58OOYBTtj2UW:iQIT7xAzW
- TLSH T12A1304686A0CD37BC4217730C6178AF92E702E42EC1C5A6FB7457F8AF8B0B5059D9E94
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Music.ico
- SHA256 96e9d5324430dfbc9e956f30a97949cf5caefa6d7003e8a2948a3feafd2aae3e
- MD5 a561bc67ea45be9dc081806684cac7d7
- SHA1 d3eb87e00a544002460bcf075ee81bfef3e5ac4d
- SHA512 023bba535460af9f9b0cbbd74dbcaf0861352eb307179f8f8f6b517da4eca5c89d6b7640c72425294af9911a4f3c732d1dad5f6333d256e229d53d248d734ddd
- SSDEEP 384:6ZCeSI6fSeoBlLXlO2VphLxSywTgowydB68BZVpfRyWi3Ps049QR8ntRo2zmUUSD:o7OtoBlp9VLL0Xtt6SwUZ1
- TLSH T1A23320B5E648ACD5D40B51F9DC24E938209BBB9A853C0951B6F7B91FA0B32C32067D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/None.ico
- SHA256 0f4deedb17a66711858b0408896a195b7839951b23ad9c804eef2bacd59f25fb
- MD5 8c4720fb2a2e6825a0f7cd11d04e5643
- SHA1 d7cdfa3709e785ef7e71e54449d5ba5c34fa1f41
- SHA512 585d8bb3018e268fe72bda7af72e94971cfc3f74660a7b6e96484782de9a852769cfafc873e1a8a95658a246780e8a5cc68e806530fcca6f84664e17fd298622
- SSDEEP 384:+dijFJ0owyd4gvhQhu1LU7J7qR8v0OnxONaZEYuJM43nDpLDsVPMCWIHR6Stus+C:RFS8sT
- TLSH T1792389A1E68C7CE5C40345F9AC38EA49205AFB5A553C4D197AB7B90A61B72C330B7D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/OneDrive_Storage.ico
- SHA256 ab469de88f1cd1039d8f53f21c049f2116babb96cefb83614f74e1154aa53529
- MD5 4e38c369c197173d358d2d94c0c1a4ed
- SHA1 15e29b89602a7cb80f49f4a966b093857055f4b3
- SHA512 54cc6ceb2fe4a57ee2de5b7f6b2062eaf58db9067fa82ec050ad34119ead49120e1235375ed24ca9685f305211b2f2d00c3cded6db974b24d5cbe39253d623e6
- SSDEEP 768:4jUtmW9Xu7WsZq7YzUM3+JC1GdeVtCRGYwxYIoE38KpVTdHBMNHMLa+C:eSF/3
- TLSH T1EBB37ACB2D0086F7CB4CF63014A3B37C072B993D6BC38E4EA55B3E4AA77265DA589145
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/PDF.ico
- SHA256 f8ba909d95238e662bbfcde357daaf95fba069d99356a8e3e467a5ecf4efe351
- MD5 b414f59dfaa68c434847e99e23ca9879
- SHA1 78ef1abeef948a25357a4b47a492ea883177a52e
- SHA512 ca0906d6026214a3f2a15bf6d53e4d20ad71fb3cf3f3cb45a8994c8f67deefc2f710fd76f8bc784cad6f9ecad1863606f801d6f2786bc258889663c93379d7d5
- SSDEEP 384:UqXB8zZ+tLDYzdSjTpyTFOG8xDnjJZlrLL0mrE:UIB8t+pMshGwflrLL0mrE
- TLSH T1CC237889F243DDE8FE13323554716D172F42AC1EA995299E31CDF6A63832213506BCBB
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Photo.ico
- SHA256 b972e03926b158884ef8b5f356718e7c67e8faf332298997cbf9209f89e65abc
- MD5 7107d29747269118f6bc781299c8b1ac
- SHA1 bc601e19c8c284a1f4412de698f350c1e10c67b0
- SHA512 cb70546d0722ac21754dbd35d455c6e42b4cceff47cbaa2235a7c18c4f2ac1bafe2eb280661a2d7ad04d23397da26b4d4cfb13dd377b7e408e2f0081c781f0df
- SSDEEP 384:f1d2dDCWfh2xXxkdykb0hv0bMxSJhnLuCL22N3HntODqrfePrWSIIOFO4tqj7EC2:fMCRXOdfgvhQnaFOnTP
- TLSH T1564393E7793F4A4CD748773131A88B463FB13DBA8923125E31EC7C5A097B4906E39A16
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Setup_1.ico
- SHA256 4e54c5f3ada5de9f79a640bf6be94217f23b4fadc76d8cb2ea1f0ff16823751a
- MD5 3065cd90608967701682da69bf91af16
- SHA1 cdccb1ad742625f7d6ae1cb286a0b34483778d01
- SHA512 f3da99d4a3085446e7ee371c525df1834549c497e6d5c4509858bec435f0ccd183a932431ccf6ff7ac199d2114862122297c3eaf5d7b8ccacf94c53baced8b96
- SSDEEP 768:pV+jtftj+etZRK/IwIkyzEPwV2BfbNO1OYQntLOa:mDj2djyz5ABfbNO1JQntLOa
- TLSH T12A3339139AECFCC1D07086B477BBA7C2DB5CEDA46462C86C26C84109C97E66379127DE
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Setup_2.ico
- SHA256 cdae831ab0b69b87d5633a2ea07941bdfc9ffcd950dc0dd379646fb33009cf59
- MD5 31251a771eb01a4371221e4b7ef80ea5
- SHA1 78ff513ca7220f288ba21a90fa8063a1174259ea
- SHA512 ca987a6a8d141174c4e135e5ecc539e0636c28002a3e3e47d39d608d5ba60445db5e51f6c792b3f29a449bc2dac2dd0931b0ce4bc80c5e4c631408280132dc58
- SSDEEP 384:Mwm6Yr8bmmWEyoXVNC6ErRdHjmftLE1qt:y6YrWpWGXT9ErjmftP
- TLSH T1C3923C867705E2E1DDB80332AA7B4B970914ED35A6D4153737E3FF1B5CB26231027A89
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Setup_3.ico
- SHA256 b9ffae6662a2ade6bd444bb48a44317304055c0d7a61c135b38c46b110d7a9d2
- MD5 03f55bc3fc8e0399418d1eccaa3cd5ed
- SHA1 f8c93b640db0e13e75e5167d43fa683c4f32b158
- SHA512 7de6ffec6cfdc98c39004f5024cfdce611ffc0d70d1ec7d51009f87d070a5337bb3eb1c70486e2848a68b10f31a908bc4e869ab25fe34c1d1833cc6832b1eeaa
- SSDEEP 384:UOF5tQKrZAtHFz1e7NQ662n3gYRMbPH++nKhn25xE:7F5tFazz1e7Nv62n3gYRN+nKX
- TLSH T108A22A41B3A0DB87F65C967280BB45E306F05E19D1B138AB148D7F3B9CA927111EBE07
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Skype.ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Steam.ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/TXT.ico
- SHA256 83b0eebd041789250dca81776123c383e96b8b24235c4331d94eb32254d730c8
- MD5 b98de4539f9ca54e380b77912ee41d2d
- SHA1 0703f2d50045e55c0ec771a5ab25c956ed332905
- SHA512 096804c38d1e0e501a68c55f2cbd89fcfa33f88df50f6cb5fe6f918eec8b23d28ef3c782a9ace26c534ef8535e6831eab4dad462c4d6dc4ff7d5d288d0c798ca
- SSDEEP 384:RPU/jVcg98vVmCHwcJXbVu7R1CUln9R9L+HtEGuewtPbdstavzwVyA+hA1VOSQ:RPIjx9Sn0sNhsSQ
- TLSH T18023FFE0ED887CF9D43342B99C64E904E02ABB6A576C0919F9B6FD1A50761C33076D2F
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/Teams.ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Icons/VLC.ico
- SHA256 e65adb3cd7a08d343c0d2c4d1c20e0213b01429a8a8113ea9d2732f4433979c2
- MD5 3f06061e0600712128b17caed76dad0c
- SHA1 71babae2068f98074799d449323f466bafa48f2c
- SHA512 f7d3098178078fe36e1ca1672c5a11545ec1cbe1b0ca26cbb4806baa8e464a348739c602ef5f98dce4b77e61ce942504f687445da5508e028122e3f0375fb74a
- SSDEEP 1536:R2VaSQ9p5G/3Gaf/nlyjfLBSsgFezI1oRNdS1EAd8IIyQS6Ym:R2k9Hc3/nl6LAHkzI1UngEA6IIyRm
- TLSH T1D063F2B05D48D507D73D173CC41B1A884A701C188AE22E4769A53FABBDE8F8D2D11AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5679768b449a8e59b5a9ad8eb6e9fcd7e03c70869da8fd7b6cec5e948aac56b1
- MD5 abf694ddb10c63e5205444b442e49706
- SHA1 8d9d2beba8240b2795b6113db9a158219e63ffeb
- SHA512 63c44c10b88f2a2655887a93b1f4b2288f99d2ae3622ff7f62a9edf4ff9325ebb66e16215572fe896e46fc335364b203f632124e9409b9f863189306a9499f30
- SSDEEP 384:IqIGejCUccJeGCJWM2YFegdT8Ft0Y7XZ316DMz:IqIGeXcWrCJ+EtYZ316Du
- TLSH T14B620755E3E54331C6FE1AB34C7323401B70C2099C53FB1E4EDC6096AF63A9986957BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
20854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 effaa01f092dda8351e6f4a4a1bc651acf91865a4f512a3a336b7e6fea495bda
- MD5 8b462f2be3497eb66347a6047180d759
- SHA1 601974b1547653fa38f84a5e2b6cef1d4a4214ca
- SHA512 6fb8226192277cfda113805154cf83c01590db1b159add775d21db0101b8c5b45847ceef27f105d0275b1b1dc692cc5774f7777795ae8e832301836bed5d4843
- SSDEEP 98304:nl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:z9FPRkC8C9OH7c2ilInz0kfVo26Wsd
- TLSH T1953623187FE18717F9EF97F1D5A2420A9BF4E053B356E79F5E9484E9388230089222D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5042578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 407b8ab86367a9064ce131fbf7b6b1bd42cbdb79f4cf84293c6774b857f3fb08
- MD5 71ba259f626d144c0f33346271691faf
- SHA1 f8447b6876f8a52c84bc6ee7f7b396be8139ba87
- SHA512 8f9d8584e5625a4f8dc133369554b5745847dad28f67cde6778bf94b5b81b17f9f7551b664868ecd322908e7b49296b3db5b4a402d4eb0dea59b947261c3cd36
- SSDEEP 384:0udf1DPfy6XhTzA9kcXCNU3eTKvt0GIKoIloh8h:0cD5xTkvXCW3WHIlZh
- TLSH T17782082997A48372CAFE1EF74C66A68053B1C3018E07FF2B6CC861AD9ED37D84651791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e6d2010f02c4a2b8372ed98728e68d740d262df05be811942e26229f21af1b9
- MD5 3873c7a085d349ee7d80f19a1d04466a
- SHA1 df563f40438603db051e97ba5d15b8d064eaa918
- SHA512 12a806f5f035c69fe4ed3859cb42e1441924185d40c23c026a57ce052c9a4060bc1d5fb7d289db4d94be093fbb763075cd667c6db5aee3541defd076c5163b2d
- SSDEEP 192:kAXyVpJlyIxlioHESRJ29u+6ZWSYASO3tOXXgNTen1i9iY6IW1mX/60/jAqEM7RL:kXVpuoHpMDfAR98STe1oi2X/6xMrwU
- TLSH T148523B59B3D44339C6EE1AB21C7392800774D715AC13FF2E2CD8A0B15DAB6D58762BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4da7b92dd81ff96931aa9012eabaa0878d13c78dc3cd840b102ce7e15fec4b7b
- MD5 35e01d48dc293c1ee38fb76a001fc6fd
- SHA1 36b5ec73b188bed24e8549f1f9244acc89e2ecc7
- SHA512 210260c3802c21a48f84bc5c865d4b8fd804258d160ca8d20032e32650f4e197a650463e6cb56e7b459b6043046be17b146d26a4ee41b0e215c842ba5ecf6cd3
- SSDEEP 384:tp4K215dISbc/TY0mN1PGDQXSBJVYol/tF37enOAkxqb8cq/hsutzgk/b7oBxkpE:h21vWk0yPGsXAr7dtRKPb8V3dmjC0b
- TLSH T131C22BAE3BD08211D5FE89B2497295080730EA039823FF5E7DC4359E9E33AD64A107F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/FileSeacher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d97563568c011b93d3149bfd062d81647b1ccb9ab87b270e39a518d108f77d1
- MD5 f7bea87f295d1d4284ae396a822950a0
- SHA1 d8c7bdac70c147dfc1432b6794a821d9b07d720a
- SHA512 8061d47255769a398d4a1f608260c211de4be71d3475d4284f0df881b371de172cc334f323ad4bb9d702ceac6de0ae700f3006d9c2e383bd41f1742d0ae8b2e9
- SSDEEP 6144:zPv5T5fIIC8W8XqeGtSV41QJDsTDDh0Yhe6dwxLV/vuhgS0mkdwcG:znfIICLlS4Ys50ie6CfigSjE
- TLSH T139A48D406BE8C657F1BF27B6C4F262A0C7B0E465A52EDB8F5D4024EE2D17340E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a9a27c74cf95673617b98fc8174a19be975d8c97fc12cfdeff472d46bc1b8be7
- MD5 1501dd127120371f65855cfa4e55f190
- SHA1 98b34223e1ee45e0e2a8756a61b0b4ba314ea9e8
- SHA512 c972e2494020f979cdee9fd45001f940975ef90f9cf8f1892a7d8b6b5e62177ae4d0d37b761740f5e4493b3d310eb3b7f548be001f87f766a0e97f09bc97b891
- SSDEEP 24576:BrKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:sHZ5pdqYH8ia6GcKuR7
- TLSH T1DC851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8918b5549441692917ab504e1ad9455d8e62eff189becadee048e6c1493d1bbb
- MD5 9dfed469828dc9a5ec89e3cd21d5b74a
- SHA1 8422ba84ef565ad495958249bc940b527e9c9460
- SHA512 ce8bdb7e820c3d910c3a6232552e2a576a4c03cc128dd6d4eba5b48f3b1ff397e0abc9918e0f08d550962b81e69dfb3cab579a2ac81e2c57658da2c35a9be9f8
- SSDEEP 1536:8SheTaT7z12BWR74mdItPighZ+7YvgxBFQ:jheTKz12BWR76BhbynQ
- TLSH T180434A4567E58A31E1FE0F76887397108771F2635913EB0E1BC5A0A96FA33828651BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 88569d549e184ef63f2c2ae4e3c3adc9d957296b6a67cf0ee94287d681cc0934
- MD5 da772b035ae5b347de1b17e2e24463dc
- SHA1 5ba3cdaf6e33c58cfd8ccecbe14310a035e00523
- SHA512 ba396154e899dca31312ab9e2a14682aed0a51b5d45db4b0c72efad5cd74767c5bde2bf90099bd886a52adcdf8abb66ff16dcd992ed6a7598ce49e3afaa95922
- SSDEEP 384:DnQf5APE80e6vkD7RQQpOJXWn3TmoNhxJNSOFD45fZ41:DnQfGPEOD7vcJKj3NSRZQ
- TLSH T104A21A98B3E44265D1FE2AB30872904513B6F70B9D13FA2D1EC8919E4D73784CA54BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e2daf2c0841090b2dff517e14acd48d393b899be1e213f001229d1af9a1de2b8
- MD5 84e36d752271a46310b0afb8482a08ce
- SHA1 2e922c41f7136f327f74354afe7eace5484cb2d5
- SHA512 0b1632a766feec97de5e30a22e6abca67119e53d8715bc22d15970731e91446b17b625614cad79d887299dbc5b5fa78c66db2b0c36167a3009a678a5086b726c
- SSDEEP 192:BLCuLDdyxqvzfZ3ium13gyWacxv8ilNwOHLnq4UP1XPeDN6IW1Y6Up90Kli8Jlb0:QuDdYe0umJ6xfwEO4UNWD8Upt15h6V
- TLSH T152825D0D77D88375C5FE9AB20C3363501BB1C209A803FB6E2DDC716A5E93B854B54AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 241be6a9343d9b9a81877af9a072dd4e3de671b6f6dedf8d19b01139cd19a516
- MD5 b09308a5c0b7e0bc67ccbe32a8d043aa
- SHA1 d0d1cc4213e5b8f721fc35753a747794e0af7afb
- SHA512 9fd8406cc75f3c10bc3c74f23d3e9b58e64ca19370162e5cfd52cfd5517240a98612093a849db3d7a011e736c09578748f8c33cddf51be737852b2dcfcf9cd25
- SSDEEP 192:IzW/qqmhqfohvEajSJz+5q6gn+jNq7gGte31HC9T6IW14X/bQeIac3t2vLOo2:ZqqmhxvEajr53xgjteFi9BX/bXwt1o2
- TLSH T184622A17A7E48271DBFE0FB24C72620117B6D609CD03FB1E29DC506A5E27696CE21772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9b73be7a27b5aa8cabf10c79a6e515db6b59962cad3945dada2eff57bb56bfdf
- MD5 8105f5149e1fea72e27f0a1455d956bc
- SHA1 6722d54df38b89284c3375efda3985155e6f5b8e
- SHA512 4f1aaa81263bb17aa7b495cab056fd9b18058247df874866bd9cb6247f180989a0d549ce0b4595c7a636e4d6279e92004c4f159c30e8b381a1a51b9d54a84d10
- SSDEEP 6144:0iwpFWBbjRTvqihWI1ElZT2J2CDt4azYPfb78+OmmN8fCgN8OQSoYCY8gQNUyFJU:LkFWBxTvTWzlZSYXbg6TSJUYTPzeVzn
- TLSH T19CC45C11BBD49627D16F33B2E0E20F2A57B1E4467326EB4F169097E89ED77424C01BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558642
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Ngrok-Disk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 61dd7fef160748b70e706e3afb21b100b55950edcf6899d97a8b8d52035bff75
- MD5 32be6f1d8c99be26ab2b1391073e3dff
- SHA1 70c186a44ec935b7083ad2981ad23df128f690bf
- SHA512 291caf23708fce9eff090df21cc78d3795435ccc47a47e46352fc456d9f2909277e657c874c7ffb603a350b0c4c76e88ec904eeca0a09955d70b4506379ce498
- SSDEEP 196608:dCsxED7kwTV6B/nCR7+AA3e5MryK5Rj1Bpw7Vdjz8wEO+Dl:dTED7/VEqt/A3TryARj1BpwLktl
- TLSH T1B37633287BD48167FBEF67F1CD92414A0BF46017B2DAE7CE19DA48FE1D81300992169B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7368622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f899ff9ec2a4e63c6b1bd14d8978550c2befc3dba18f1c97e4f9e01f24890b6e
- MD5 074e336fb076c4805fea3b1b07655f19
- SHA1 39c402b592deef46c4e5d2f45fe4f29cbd5e6ff7
- SHA512 2e2b0a0f61b2498d3042d313f820aabc2903f8ab567c22a0c414b500d0e382e6f00cf4aed941ea2830e4123823036215a3802e11b849e348a4f737bb9decf03e
- SSDEEP 384:GUd0+k0mA1+2EyhoafV8bKKJtMCNI9LfGyHs5RBndE9Lz9NRc3Bw:GUdSO+i3yb4Lfds5RNW9jRce
- TLSH T175B2F950B7F40668F5FF0F35AEB561248A36FC469D22EA1D4984600E5C73AD1CAA1F36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c73d14b4de11e7d8f4dd65105280083086570ded5908870ad07a04f436de1e3
- MD5 7d76bd3c8ef11f53723287989ef902cf
- SHA1 71a14614ce2b85920092fd701d8264910f1ec40a
- SHA512 1fd0ec708123066b793c2f54b521bfc0b18b8383f913745fcbc20cd82d7dbb1c141e93bcc88e2a66a876266d613151467b72b7119d768ddf9b65fa97bda3baad
- SSDEEP 384:hzO/ClGe/9GGzHQl3HREpi5/mY7//Al5sA8/rHbx:hzO/CEe/9GGzHQxH+wH/dA8/rHt
- TLSH T104822A255BE58271C2FE1EF148B3B3000379E342DE03EF1E99D87516AD73986C620BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82e3f38ad7eef287a4260eb85d714e46e556316216aae2e140a7a033d4f2fc38
- MD5 b6ed904707d2b528c50933ee38affb86
- SHA1 9266c83fda87c3d627f646f49adf677c06d49d0c
- SHA512 bffe33724146e3993687236eff3f54ab1e3c21085b77a7dc255796e91564b2e0fa4a56e406a66f5bf76345f0b0d3cbffe873bc03908d3bc83ab95aea2edabd68
- SSDEEP 384:BmdLFVZ8ERBT32czPbHmTgK62QxHS7OVpw7EqV:4dLDbRBT32czDuCHsEu
- TLSH T12F621919E3E58239C5ED4AF20C73A2011B71EB039D13FB2F49D860965F735898E64BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2191a38b79181dd20e9d52b3c56e3b1d22e2329fa0155be726bad5067c2d70a4
- MD5 7f50e25c5c32c9f8ff91ad53effc08c7
- SHA1 e30b19c59d82f4bd6abf0b03f5bcae5783401861
- SHA512 ed715a1c1a218363baf2e9d34207f37d2a8a05322fd59d0656c3f45c16a2079a4c1ae85b48a061bd21ad0a6f002a596038f6783a86a8026fdd317c4db0e664bc
- SSDEEP 384:ZdftFqxTfNDgiIsCH9q/Y1aLCEYpt1pnrDhg5XkAvfw5bZLnVb:ZdftIwn8TYMXkAv4L
- TLSH T1D4723B1EABE493B4C1EC1EB218B396410770E60ADD23FB2E1DD850276E737958B31795
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 665dcd8409d509bfd79d77c7367c50aeefe1ca893392804145a7c368e13e6e15
- MD5 96cdc5f67e9dd2fc5bac8770380e8373
- SHA1 652d93d22b21ce0d3575f7b5a942b66e66655d4d
- SHA512 663b79e49e5636d330fd82d2721ce9b5838a284eb2d4ba84bb747590ad83916efb39b4219dc2f489110f9c14e4629fcfbc469b9900496801119eeddf5ecbdd09
- SSDEEP 384:OjnqNd9cZMvidxD/nTu1NYTX/1bRbBvFxb:OjnqNyBFTN/13vz
- TLSH T13952075973E4C23AC6FE0AB21C7362401B31EB059D03FF2E16E871865DA79958760BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1c5d8bf7908b8d38a94ba4559d3d910a3c2dc02a4cae3e48b1edeb253ff94b5f
- MD5 6d761ab6a3ad9c15a91d64cb065f7788
- SHA1 6865e844e66ed9df5978cb7bcf9c2380fcdd4763
- SHA512 09c39d67d699b3715eda5973169f2afb8d5d7412eb25d664eeea3d6fc4942aa841b934a72824571907104b7d5de75ad9890b3383c10ebe47724b4b1fcccaf761
- SSDEEP 384:vVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7EPPeEHtHxh:vVm7Q1vpebF0LC9TqH2Mj7qPtR
- TLSH T1A792F62D67E0E171DCBF1AF354B3D2510371DD35A821F62C3ACEB0AA1FB21498295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97d084dbaf65e0395221928be84907c5dfc51d8e0b9d8c8cad659e49e821bd61
- MD5 cecabf12d9b0ad0a1ee42a47933dca88
- SHA1 c0f022eeeeb28eb0ab430253bc994c86baebe696
- SHA512 d84849f1f7fdc41d3fdc5929a8ae5a7f6fb9646ed10867e47e7b9b868bf8ef427b4c70a0455ea368947a3c01d07a515514ec1b624129b0da607b0fb1ef46b9ba
- SSDEEP 12288:YMEW+SHIWnFEn6YwriYW+aiJdIyl1HXuKtMCiK:SW+iIWqnwiYWefrXuj
- TLSH T113B4F15827B88A64E5FF4E7EB0B0002543B1B1476A53F79E0FE488E92E71784CD15BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
514318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\PC\Desktop\XWorm V3.1\XWorm V3.1\XWorm V3.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd62c8cc46c9b675de1a8628dca32e2a0f2e3b754589f0f97d741ac5d7626939
- MD5 25553d1f11ed55f924809441ca0c8818
- SHA1 6c550d43501034ec008f33aa4474ab6fbbeaadae
- SHA512 cd1d7fd003b5b5bff44e336cd7a9cb41ebf10d14bfeecae0fdcc3a9ffd099c9286e6e4b6a86a80f7e1827f3d0823fa577ee7733fe74a3a70832912f600abcacf
- SSDEEP 384:8jKSC4zdLNUpTmeyAYvpYrQcfx9A8/QYbleZ:8jK1wrUs5Y0IA8/QYs
- TLSH T13C62086AA7D58331C7EE0AB318B392004371E71A9803EF5F5FD821969E6719C87907A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 91e582dd0fe0224a74b326faa35161958aae425df4b6151646b9c330e7bd5487
- MD5 83777409ffa9472a16ca8ac82405fd79
- SHA1 a3885194e9633005838d82875e939ff79c41279d
- SHA512 09211008a5c622bda027b165911eabce4bc60874bee172444db3b95c0b7b148928fb5d81a0ce9b46d5bf49eae22d72ccb98fd6d252768bafc418b1c79dfc7576
- SSDEEP 384:OQfYHHHKs7KD2Z/PY+gQ9ulAdfV9q/T6t5wxt9drOpGrjzx:zR5YPY+gPluSft3rj1
- TLSH T128823B5EB7E58375C1AC0AB28D73E3015734C1078503FB1F1DD8A06A5EA3B868751BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6afbc76999e2461f73db5173045772c1ae75912d1dd5c9afa49a8f153a94bcc
- MD5 bd851b7e1041a3f0baccd36197d6cfc4
- SHA1 9f30138e51a85b8d43750acaf5e62a76cfda0e5b
- SHA512 411335c7f317f028f33122f64e01f21352b0356fc192feb16485078712f1ad975841df84a0247328dd0c4e15e5f68510ecd6b77b4c5013d07fe31622b7b3b49e
- SSDEEP 384:545RejLUCUPxVPdN7FAv8zTNrxYFXoaFlS9IcPCv:54HGUCUZV1N7FLfaoaFQ9IcPY
- TLSH T1A972081D6BF68372C9EE1BB205B2A2005770D605D813FB2E5DDC30970E776968694FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 142b3db9ceee2c45baae4a39cec35110b7d1a2d4a567d0a3846d546454a38c9c
- MD5 dcef0b57855b19de439a960ab318ccc8
- SHA1 e7379df475d57778cc5758006c30b9bff20f193b
- SHA512 6fa2e98c62bffa471687034ef65812108b59f24a2a9a9669aa4fa4dafff4c69bb4a62011599a4cf92eda1c7f49bdb408796a958a53ff405d76c9fd7e19c5a442
- SSDEEP 192:cbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse8po7SLOYN:cbChWqPj5jJtGUse8poHYN
- TLSH T14A321A1D93D4C679C9EE0EF24CB222811BB2DA448E57FF3F55E4A0261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e2cf9a6ce187c062019e955ff60f4fc3ef815c130c306272e592accf4fc927a
- MD5 dc65e652272a02747e378395977bd157
- SHA1 9bca82693a41b155a7d9f875416f69b93d35a615
- SHA512 390e93db51e7c71b83c8710d8b36534622d17b2ae0c11f60794a9bfee68ae35d266e392191473929b04ca921f819c6ebda54293d9c8e148a3ffa1ae509baab5e
- SSDEEP 384:VLpmyvwJaBVUP8tTZ1xYsSh8KzcEEJjm:VLppYJIVU09kh8KzcB
- TLSH T1B162086873D4877AC6ED0EB30DB353012B70DB059D03FB2F6ED860561D63AC94761A62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 201ae5b49c07fda351c4b97dbc25666e70e8e5ab5df496a706289c7afb329e72
- MD5 2a11f28ef6f0a17489ba5b476bc48e13
- SHA1 40cefb38747bab538b19a8205bbf51364625098f
- SHA512 7e74fe0a7c8921ecb87b714a0626c49586a01cae402c35992ed306e3c5de2330e843f6a39ce27fd352d1c7505aef61c124111c55ccfe12bf05ab1eebb4f43baa
- SSDEEP 384:Xw3mb1rUAz2nvV/Vd1vRHfF88XT0L6YpU1b0XNpQ:Xw3mJrUao/d15/vDt1baNu
- TLSH T19C623905A7D58276C6FC89B61C73674117B1D306DD03FF2E6ED861AA5D632C18A307B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec540fa8defea128625dde7048d9950b031c34f862b2f0bcf36fa299e7f33361
- MD5 7eefc1147e91cc5d39bb4ba32bae6f0a
- SHA1 de720a7c7091fcdfbcce75fa42a531768e50cb45
- SHA512 c74786c7fdd863dec2862cd73e6a1589be281cfcddcd126e59897ce78bb459b75140d65e7d807eaf2a9733214f371373f22048ce18879b3d844e309f6d45e9a0
- SSDEEP 3072:gtkjKRhBK2A4kjTUsq7EHBAnpK37nXF83+4QvC74Syoh+0KrywT6RXHLzgaUcndn:g6jKRhBKvjTCo8Fm6dfCcn
- TLSH T1EB142A4127A8C92BEBBF17F9E0B1160467B4F10B9561EB8A788C15F95B533409A133BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6871508aa8360a03223704c56036374915ddf13a94127d73f7eb258589578dc
- MD5 ab5991f44a21e87e3b78406f799f08b0
- SHA1 c87f102de6d8a2d07eebd5be82d5838e7aa61f6f
- SHA512 9bbc9cd2ca8c6045cd409d6bc3fb8cde58ab111ef96bf06804291ff789303684a01ea426c88c2a73b232673fd0034403d1c36533f4766a3c64458724aa0fcbe3
- SSDEEP 192:Cjg7Ks3wBH3Ud9eGLVOpkidXiS+O6FtQi11OtCEox0GTeE1tZ/J6IW1Gz/t/GYrb:L7Ks3wcxIdo3wCzTeST/Zz/tF/v
- TLSH T1C3722B5C63B5837ECBED0AB208B3A14113B5DB0D8D53FF6E18C8B1655D53A888721BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f74d0d016931317a50ea86ac1f848b80c4abf6ff3f50d25421b9b6eb397c7422
- MD5 def5b65a3279d008274bc8888b25a7c9
- SHA1 55baaabbfa4d785762eaf6e4af0b5556563cd44f
- SHA512 44197a9078e113e5d4e97b4e0ef85e3881b0ad543a7aa9c829fe1b0c12d21a76d94083ff0335930bbb0e1d071909fc00523c46fa42a839ed845eaf0269ca2ffb
- SSDEEP 192:XsVXJUI2n7bL8JXGO9mWbpN1gynYDIW1vr/C296alhFs7xUWriSLuTV:8V5UIs7bT0mWbPGynY9r/zFlhFszrwTV
- TLSH T14842A55977E44274EA7A1E719FB2D3520B71FE088D37F72E18C4904A4C7E7058BA2B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b0b1707cabce3d01fe71f125dbbf7300516f66f7fac04dda29e55e57fe208cb6
- MD5 521948bd108e6ca220616c81df947c76
- SHA1 532210636bd0a0da86471287c38e101ae2b4129f
- SHA512 48f7321824f073e7816607891a84070b31539af347140d949042af5a76802472af507812082672e22f6164febc36eb584f2ca350a2b97ccdd3ffb130f1f20597
- SSDEEP 192:gWgDO0lNTlnqybcTwBJA+wGnzOSeJyxlTen1W9gotlF6IW1oXxvK0WQEcGSL25L:wO0lZ8GcQA+ZeyTe1sgIXxvMQEcoh
- TLSH T1C0621B6963D84371C6EF0FB21DB2A20053B0E705DC53FF1E5ECC619689636988365FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b07315d089964ec6357af66f2621df32feb527a7853bd5d3bf37ae129252a53a
- MD5 eb91cbbdb03eec49b478771bc3314a7a
- SHA1 9d1232bf302c4d9c050d688a5fcb04df07b99f97
- SHA512 628e6f8d5ac4fa341b8e75ccab9d55ce3a5c1b0d38363331f9f6b7c1baa007ce9fc6d5799d816595dc1b4b073cc223d5b56b017ec4c7e7eb5d4cb217210f0f3c
- SSDEEP 12288:/yGwLs78GJUndM5/zobglKwMBW5pKg/+VnSXhu5:KGwO8GJUndM50bglZMBW5pqSxu
- TLSH T160C45C11BFE49567C16F33B2E0E20B6B57F1E48A7226EF4F059086A95EC37424C41BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de0f4cdc1b47fd8ec7ab80da12a4df7277f78001e12d9ed95e92696802f0ab9b
- MD5 3ec8fc17fbf8c62fc89cd8f2e793a50b
- SHA1 43d7634455a90e43c0dec357f96690e31e2a1930
- SHA512 83f7c7a9ce9e35fd41957a2ff3dd1cbd285688db5f0f261865ef6d0054917e6837ac8396ac67735547321f165ed1f0ba67b35a408fe74b5f6161cbfa37ec4264
- SSDEEP 3072:yr2hWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJx3:yE+22fFcgBgakL320zYZHpMXM/fWHx
- TLSH T178247D06B3E5807AD5BE4A3588735A189779F8118B71DFAF1B94025E0F633D18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Rainbow Dash RAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f6a048754437986a1a79f0f88829e3f52d66d2b9b53f8fd288141df6cc0d1b43
- MD5 ad83d8d88abfaae4c800f796b2d52fae
- SHA1 80c0edb1d47b737cfb4ede6ab9881e8bc14251cb
- SHA512 ee11dc1eec7219597dd03acd9672fd44b56def970e6d0f56fbb0c36d2a6f06becff74e3eb9fdbf6788c5f0ea63da281fc20399939e829b6a7ad9b730d188d27f
- SSDEEP 98304:321XK65Rn80+kNgoTTtLP9Pk6gAK6n4ldyNhYHc2pDsQnqywPz2K:321Z5RnPNg+L1kehn4ivqD1qy
- TLSH T128466A1373A1E429CA3806F129519FD152B66F1E4D308AFA398C67BD2FF26C4B5947C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5446998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/RainbowDashClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0c8e9ddb374b4dd317cfc646fa4985f03ab89abd19690843f770185f3b62fa26
- MD5 8c1f26a43ef521c7f4556b13b954a61a
- SHA1 86860efcfa1bcd26cdbf27aa82a266bd18dd9347
- SHA512 c6daa33abe3b285778fb08d01db15fce762e95b3a4c68feeddc690f70570ab890f4e38c894ca308a9b4d133fcde76619762ec157750135a1356860013c0b9b32
- SSDEEP 768:AaVCsFJpXzXaMYAoRSF2uBFE9RTOqhXbo:jVCYJh7F24FE9RTOq5M
- TLSH T108E23B487BE54327D6FE2FB229B2A1010375D507D913EF9F4CD885AB6F67A8146003EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RainbowDashRAT/RainbowDashRAT/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
RainbowDashRAT/RainbowDashRAT/Sounds/Intro.wav
- SHA256 ecfba4c4ae0a2e64ec00de85a4de069ce5a6b68a3a2f11040dd6aff6c9c6a593
- MD5 ec50324ea5f4e4ac2646561333aaee98
- SHA1 5a079532674df04933f5f01975097bbbbcaa78ce
- SHA512 3e8cf4a6ee6190c6a0439c9b4d6353cd8407e634ee628795520c1bfefa797fd260be8f7d07cf2360b548b79210796cb16814d796b20546aac0aac4a164ec02c2
- SSDEEP 3072:EDcKfVMnHsVQpQgyasrfMSsGatsuBzBIhFKZ/A3OvkGe8gSoeUoqhGK+:EQKfVMHsVQpQg5srEiatDzBIhQ/A3Tkh
- TLSH T1B0F3BE42F042C140D9379E36CE96E8D546A2BD5EFE15562F30C8BF0F72B33519A22B99
- MD5 SHA1 SHA512 SSDEEP TLSH