General
- Target jaffacakes118_39a2d03ee7aad14ed0d70a7a8da81f4c606fcb14128073b4ce52b44d5d0aabe1.bin
- Size 2.0MB
- Sample260927-e9588a1tbw
- SHA256 39a2d03ee7aad14ed0d70a7a8da81f4c606fcb14128073b4ce52b44d5d0aabe1
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_39a2d03ee7aad14ed0d70a7a8da81f4c606fcb14128073b4ce52b44d5d0aabe1.bin
- Size 2.0MB
- SHA256 39a2d03ee7aad14ed0d70a7a8da81f4c606fcb14128073b4ce52b44d5d0aabe1
Score10/10Detects ProRat payload
Family: ProRat
ProRat is a Windows RAT written in C++.
Modifies WinLogon for persistence
Adds policy Run key to start application
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Executes dropped EXE
Loads dropped DLL
Modifies WinLogon
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2