MAR-10382580-r2.v1 – RAT | CISA
Tags
Common Information
| Type | Value |
|---|---|
| UUID | 41359cf6-bfb3-4f2c-a959-8cd57b3711c5 |
| Fingerprint | 8412f918cd790bcf |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | July 18, 2022, noon |
| Added to db | Sept. 2, 2024, 11:20 p.m. |
| Last updated | Nov. 17, 2024, 11:36 p.m. |
| Headline | MAR-10382580-r2.v1 – RAT |
| Title | MAR-10382580-r2.v1 – RAT | CISA |
| Detected Hints/Tags/Attributes | 54/2/28 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://www.cisa.gov/news-events/analysis-reports/ar22-197a |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 469 | www.cisa.gov |
|
| Details | Domain | 3 | pivps.com |
|
| Details | Domain | 1175 | gmail.com |
|
| Details | Domain | 154 | us-cert.cisa.gov |
|
| Details | Domain | 84 | malware.us-cert.gov |
|
| Details | Domain | 84 | ftp.malware.us-cert.gov |
|
| Details | 2 | pivps.com@gmail.com |
||
| Details | 84 | submit@malware.us-cert.gov |
||
| Details | File | 1 | ilasvc.exe |
|
| Details | md5 | 5 | 3764a0f1762a294f662f3bf86bac776f |
|
| Details | md5 | 5 | 21fa1a043460c14709ef425ce24da4fd |
|
| Details | md5 | 5 | e9c2b8bd1583baf3493824bf7b3ec51e |
|
| Details | md5 | 5 | de0d57bdc10fee1e1e16e225788bb8de |
|
| Details | md5 | 5 | 9b071311ecd1a72bfd715e34dbd1bd77 |
|
| Details | md5 | 5 | 05d38bc82d362dd57190e3cb397f807d |
|
| Details | sha256 | 5 | 4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f |
|
| Details | sha256 | 5 | f7f7b059b6a7dbd75b30b685b148025a0d4ceceab405e553ca28cacdeae43fab |
|
| Details | sha256 | 5 | 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16 |
|
| Details | sha256 | 5 | 7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751 |
|
| Details | sha256 | 5 | 33b89b8915aaa59a3c9db23343e8c249b2db260b9b10e88593b6ff2fb5f71d2b |
|
| Details | sha256 | 5 | 3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0 |
|
| Details | IPv4 | 1 | 151.106.30.120 |
|
| Details | IPv4 | 1 | 151.106.30.0 |
|
| Details | IPv4 | 1 | 151.106.30.255 |
|
| Details | Url | 43 | http://www.cisa.gov/tlp. |
|
| Details | Url | 53 | https://us-cert.cisa.gov/forms/feedback |
|
| Details | Url | 84 | https://malware.us-cert.gov |
|
| Details | Yara rule | 5 | rule CISA_10382580_03 : loader {
meta:
Author = "CISA Code & Media Analysis"
Incident = "10382580"
Date = "2022-05-02"
Last_Modified = "20220602_1200"
Actor = "n/a"
Category = "Loader"
Family = "n/a"
Description = "Detects loader samples"
MD5_1 = "3764a0f1762a294f662f3bf86bac776f"
SHA256_1 = "f7f7b059b6a7dbd75b30b685b148025a0d4ceceab405e553ca28cacdeae43fab"
MD5_2 = "21fa1a043460c14709ef425ce24da4fd"
SHA256_2 = "66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16"
MD5_3 = "e9c2b8bd1583baf3493824bf7b3ec51e"
SHA256_3 = "7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751"
MD5_4 = "de0d57bdc10fee1e1e16e225788bb8de"
SHA256_4 = "33b89b8915aaa59a3c9db23343e8c249b2db260b9b10e88593b6ff2fb5f71d2b"
MD5_5 = "9b071311ecd1a72bfd715e34dbd1bd77"
SHA256_5 = "3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0"
MD5_6 = "05d38bc82d362dd57190e3cb397f807d"
SHA256_6 = "4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f"
strings:
$s0 = { B8 01 00 00 00 48 6B C0 00 C6 44 04 20 A8 B8 01 }
$s1 = { 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 }
$s2 = { 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 }
$s3 = { C0 03 C6 44 04 20 9B B8 01 00 00 00 48 6B C0 }
condition:
all of them
} |