General
- Target 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive
- Size 4.4MB
- Sample261004-wkavfstfkf
- SHA256 5084876479bbbfb818033085cba362a3eaee8b784db172271f4cdba0243a3e88
Score
10/10
Malware Config
Targets
-
- Target 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive
- Size 4.4MB
- SHA256 5084876479bbbfb818033085cba362a3eaee8b784db172271f4cdba0243a3e88
Score10/10Family: WebRAT
WebRAT is a Windows RAT written in Golang.
- Custom signature
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
Detects executables referencing many IR and analysis tools
- Custom signature
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
Detects executables referencing virtualization MAC addresses
- Custom signature
UPX dump on OEP (original entry point)
- Custom signature
detects Windows exceutables potentially bypassing UAC using fodhelper.exe
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Executes dropped EXE
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.