winlol | 18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47

Resubmissions

09/10/2026, 13:21

261009-ql6qmagy8x10

08/10/2026, 14:46

261008-r5f5raywhy10

Sharing

Copy URL Twitter E-mail

General

Target
18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47
Size 5.7MB
Sample261008-r5f5raywhy
SHA256 18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47
MD5 fc5490e85cfbe0f2a8e801dc76512920
SHA1 12f09dc9e9b44224c28f551f1f3558f099db5736
SHA512 9247370cad61aed7f88f065713a8c90d023d3308c0b6d302623f8f745498e2acc37a73e67487f4002907091357d6134fe6fcd1634acdf741da55ae82e517558a
SSDEEP 98304:P+OYZtTgr9gw1kn8wbnazS2iT33EI5pYolng+QZCZFgZ:EZtTaib3LbgfZi6
TLSH
T1E7565C16F25610EDC07ED174830AA232FA71B84957347AEF4AD09B212F62FE05B7E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat winlol

Malware Config

Extracted

Family

winlol

http://workinghardo.link:80

xor.hex

Signatures

Family: WinLol
WinLol is a Windows RAT written in Golang.
rat winlol

Detects WinLol Rust loader 1 IoCs

resource	yara_rule
sample	family_winlol_loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47

File Explorer

18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47

.exe 5.7MB

18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47

IMPHASH 8bd439ee9efe3fca172d54e14cee77b0
SHA256 18868595393c5345e99ebe6dbfe60780aef388836b125696a3201f1a88e67c47
MD5 fc5490e85cfbe0f2a8e801dc76512920
SHA1 12f09dc9e9b44224c28f551f1f3558f099db5736
SHA512 9247370cad61aed7f88f065713a8c90d023d3308c0b6d302623f8f745498e2acc37a73e67487f4002907091357d6134fe6fcd1634acdf741da55ae82e517558a
SSDEEP 98304:P+OYZtTgr9gw1kn8wbnazS2iT33EI5pYolng+QZCZFgZ:EZtTaib3LbgfZi6
TLSH
T1E7565C16F25610EDC07ED174830AA232FA71B84957347AEF4AD09B212F62FE05B7E719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects WinLol Rust loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4600768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dropper.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ole32

CoInitializeEx CoCreateInstance CoUninitialize

kernel32

SetEndOfFile GetCurrentThreadId UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate DeleteCriticalSection HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError TryEnterCriticalSection GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryExA CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CompareStringOrdinal FreeEnvironmentStringsW GetSystemInfo LeaveCriticalSection WriteFileEx SleepEx SetLastError EnterCriticalSection InitializeCriticalSection SetFileInformationByHandle SetFileTime QueryPerformanceFrequency LoadLibraryW HeapCompact RaiseException AreFileApisANSI ReadFile HeapFree UnlockFile CreateThread LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary SetHandleInformation WideCharToMultiByte GetSystemTimeAsFileTime ReadFileEx DuplicateHandle RtlCaptureContext GetFullPathNameW GetSystemTime GetSystemTimePreciseAsFileTime FormatMessageA GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetProcessId GetEnvironmentStringsW CreateFileMappingW MapViewOfFile GetStdHandle QueryPerformanceCounter SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetTickCount lstrlenW FlushFileBuffers CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW RtlVirtualUnwind GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW WriteFile VirtualProtect GetProcAddress GetModuleHandleA LockResource LoadResource SizeofResource FindResourceA HeapDestroy FlushInstructionCache GetCurrentProcess HeapAlloc GetDiskFreeSpaceW HeapCreate OutputDebugStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot CloseHandle TerminateProcess OpenProcess InitializeSListHead SetUnhandledExceptionFilter LockFile SetFilePointer RtlLookupFunctionEntry GetFullPathNameA

shell32

ShellExecuteA

ws2_32

WSASocketW getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket recv send getpeername connect freeaddrinfo closesocket select WSAStartup WSACleanup

oleaut32

SysStringLen SysAllocStringLen SysFreeString GetErrorInfo VariantClear

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

vcruntime140

strchr memcmp __C_specific_handler __current_exception_context __current_exception strrchr memmove memchr __CxxFrameHandler3 memcpy memset

api-ms-win-crt-math-l1-1-0

exp sin asin log acos atan log10 atan2 floor asinh tanh acosh round log1p _hypot powf pow fmodf tan cos fmod truncf ceil sinh cosh __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

strlen strncmp strspn strcspn strcmp

api-ms-win-crt-heap-l1-1-0

_msize realloc malloc free _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _seh_filter_exe _register_thread_local_exe_atexit_callback _endthreadex _beginthreadex _initialize_onexit_table _register_onexit_function _crt_atexit terminate _c_exit _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale