existrat | a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0

Sharing

Copy URL Twitter E-mail

General

Target
a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0
Size 885KB
Sample261002-q192la1tex
SHA256 a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0
MD5 b92a1ea2dac84a51773a53077c7f825a
SHA1 452cacb3015ac885d933a14cae082274e6655b5e
SHA512 60e24e4861165b8097f13da0a7b3abc9403ce2aec2ce208f4070e860d090bb6212ca5672e28f5aa2c36a7ff7684a73a53c5a95d7549d19efc97855f59a6e8f67
SSDEEP 12288:dNKWniw1HrOgEAdCJuRr5gbveB7quPiW/0LwfSnSls5:dNKuiiVEAYJGG7elnKWU
TLSH
T1D1158E2BBAA401B5D4B7C07CCD636517EAB1785A03719ADB03E08AA93F277E0467F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat existrat

Malware Config

Extracted

Family

existrat

82.197.70.119:27063

Signatures

Family: ExistRAT
ExistRAT is a Windows RAT written in C++.
rat existrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0

File Explorer

a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0

.dll 885KB

a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0

IMPHASH 69fd1a1724824907e840b4b6b12a729d
SHA256 a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0
MD5 b92a1ea2dac84a51773a53077c7f825a
SHA1 452cacb3015ac885d933a14cae082274e6655b5e
SHA512 60e24e4861165b8097f13da0a7b3abc9403ce2aec2ce208f4070e860d090bb6212ca5672e28f5aa2c36a7ff7684a73a53c5a95d7549d19efc97855f59a6e8f67
SSDEEP 12288:dNKWniw1HrOgEAdCJuRr5gbveB7quPiW/0LwfSnSls5:dNKuiiVEAYJGG7elnKWU
TLSH
T1D1158E2BBAA401B5D4B7C07CCD636517EAB1785A03719ADB03E08AA93F277E0467F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

486476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\mdrab\3D Objects\rat\ExistRAT-Client\ExistRAT-Client\build\Client.pdb

kernel32

CreateToolhelp32Snapshot Process32NextW Process32FirstW WTSGetActiveConsoleSessionId GlobalMemoryStatusEx GetModuleHandleW GetComputerNameA MoveFileA FindFirstFileA GetDriveTypeA FindNextFileA FindClose MultiByteToWideChar CopyFileA GetFileAttributesA FileTimeToSystemTime DeleteFileA SetFileAttributesA GetLogicalDriveStringsA RemoveDirectoryA SystemTimeToTzSpecificLocalTime CreateProcessA GetDiskFreeSpaceExA CreateDirectoryA GetTickCount SetHandleInformation TerminateProcess CreatePipe PeekNamedPipe FlushFileBuffers GetExitCodeProcess OpenProcess K32GetModuleFileNameExA K32GetProcessMemoryInfo QueryFullProcessImageNameA GetTempPathW GetVolumeInformationA WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage DeleteFileW CreateProcessW ReadConsoleW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation HeapAlloc GetFileType GetStdHandle GetCurrentProcess QueryPerformanceCounter CreateEventA CreateSemaphoreW FreeLibrary GetProcAddress ResetEvent QueryPerformanceFrequency LoadLibraryA SetEvent SetEndOfFile CreateFileW WaitForSingleObject SetThreadPriority WriteFile ReleaseSemaphore ReadFile GlobalUnlock WideCharToMultiByte LocalFree GlobalLock CreateThread CloseHandle DisableThreadLibraryCalls GetLastError GetTempPathA Sleep GetModuleHandleA SetFilePointerEx GetFileSizeEx GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCurrentThreadId GetEnvironmentVariableA RtlCaptureContext GetStringTypeW WakeAllConditionVariable RtlUnwind GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime SetErrorMode InitializeCriticalSectionEx LCMapStringEx GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

GetKeyboardState GetSystemMetrics CallNextHookEx DispatchMessageA GetAsyncKeyState OpenClipboard PostThreadMessageA CloseClipboard SendMessageW MapVirtualKeyW SetWindowsHookExA LockWorkStation GetWindowTextA ExitWindowsEx EnumDisplayDevicesA SendInput ReleaseDC SetCursorPos GetDesktopWindow OpenInputDesktop MessageBoxA CloseDesktop EnumDisplayMonitors GetDC DestroyWindow BlockInput GetForegroundWindow DrawIcon ToUnicode PeekMessageA GetWindowTextW SetThreadDesktop IsWindow UnhookWindowsHookEx GetCursorInfo GetIconInfo TranslateMessage GetKeyState GetClipboardData

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC SetDIBitsToDevice GetObjectW SetStretchBltMode DeleteObject

advapi32

LookupPrivilegeValueW CheckTokenMembership FreeSid OpenProcessToken RegDeleteTreeA RegCreateKeyExA RegSetValueExA RegEnumValueA RegDeleteValueA RegEnumKeyExA RegOpenKeyExA AdjustTokenPrivileges RegCloseKey RegQueryValueExA AllocateAndInitializeSid GetUserNameA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantClear SysAllocString

ws2_32

connect ntohs socket recv setsockopt getsockname WSAStartup getaddrinfo freeaddrinfo sendto WSAGetLastError closesocket send bind

avicap32

capCreateCaptureWindowA

gdiplus

GdipDisposeImage GdipFree GdipGetImageEncoders GdiplusStartup GdiplusShutdown GdipAlloc GdipCloneImage GdipLoadImageFromFile GdipGetImageEncodersSize GdipSaveImageToFile GdipCreateBitmapFromHBITMAP

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey

crypt32

CryptUnprotectData

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

urlmon

URLDownloadToFileA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

wtsapi32

WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

666KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

a4f5aac004626bcc71ba94695ed4445825cd81382121ea959c0df69c0ae02ae0

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

avicap32

gdiplus

setupapi

bcrypt

crypt32

d3d11

dxgi

urlmon

wininet

wtsapi32

generic