Overview

overview

10

Static

static

10

6d031d51ff...8a.exe

windows10-2004-x64

10

6d031d51ff...8a.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
  • Size 410KB
  • Sample261027-g3tb7a1zev
  • SHA256 6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
httpratdefense_evasiondiscoverypersistenceratstealer

Malware Config

Targets

    • Target
      6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
    • Size 410KB
    • SHA256 6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryhttpratpersistenceratstealer

    • Detects HttpRAT

    • Family: HttpRAT

      HttpRAT is a Windows RAT with stealer capabilities written in C++.

      ratstealerhttprat

    • Executes a file named after a Windows system binary

      The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

      defense_evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks