rat[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rat.dll
Size

1.1MB
MD5

d96e58813b9065ef39bf512713248485
SHA1

2afc6de7b71ffec4beb3af896a152c36709a3a17
SHA256

1cc23de557ea180f1edb02754493e5d895a662a27cfe9848c968de9a5e33d8a6
SHA512

aaa93aa13a9d1542d51e49c9b9ab86df830e6e2663f4bc77dc9fbc07492e3a228a427f21207d4fe05dad54d2944d3c33d024b1ffeaeb3bdd4b21d982743dbc92
SSDEEP

12288:hOllau37yN7pla8VsYDOmnSrSlRoS1ll6iCJguZUT0XY83f:haNYDarSlH1l4/XY83f

Score

N/A

Malware Config

Signatures

Files

rat.dll
.dll windows x86

622c2eb34f4b3398c5f60a739a4808ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3dx9_43

D3DXCreateLine

kernel32

GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
GlobalAlloc
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateThread
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
GetLastError
GetProcessHeap
FreeLibrary
GlobalUnlock
GetSystemTimeAsFileTime
FlushInstructionCache
EnterCriticalSection
InitializeSListHead

user32

EnumWindows
SetWindowLongA
GetSystemMetrics
mouse_event
GetAsyncKeyState
CallWindowProcA
GetWindowThreadProcessId
DestroyWindow
RegisterClassExA
UnregisterClassA
DefWindowProcA
LoadCursorA
ScreenToClient
ClientToScreen
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
CreateWindowExA
EmptyClipboard
IsChild
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetClientRect
SetCursorPos
SetCursor
GetCursorPos

msvcp140d

?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
_Mbrtowc
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_Xbad_alloc@std@@YAXXZ

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

xinput1_3

ord4
ord2

vcruntime140d

__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
_except_handler4_common
__current_exception_context
__current_exception
strchr
memcmp
__CxxFrameHandler3
memset
memmove
memchr
memcpy
__std_type_info_destroy_list
strstr

ucrtbased

strcpy
strncmp
cos
sin
sqrt
acos
ceil
floor
atof
atan2
pow
calloc
_invalid_parameter
_CrtDbgReport
_CrtDbgReportW
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
fmod
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_initterm
_initterm_e
_free_dbg
_wmakepath_s
_wsplitpath_s
wcscpy_s
toupper
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
ftell
fseek
fread
fflush
fclose
_wfopen
__acrt_iob_func
_wassert
strncpy
strcmp
_calloc_dbg
strlen
wcslen
fabs
qsort
malloc
_except1
free

Sections

.textbss
Size: - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 941KB - Virtual size: 940KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

622c2eb34f4b3398c5f60a739a4808ec

Headers

DLL Characteristics

File Characteristics

Imports

d3dx9_43

kernel32

user32

msvcp140d

imm32

xinput1_3

vcruntime140d

ucrtbased

Sections

.textbss Size: - Virtual size: 449KB

.text Size: 941KB - Virtual size: 940KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 23KB - Virtual size: 50KB

.idata Size: 6KB - Virtual size: 5KB

.msvcjmc Size: 3KB - Virtual size: 2KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 35KB - Virtual size: 34KB

.textbss
Size: - Virtual size: 449KB

.text
Size: 941KB - Virtual size: 940KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 23KB - Virtual size: 50KB

.idata
Size: 6KB - Virtual size: 5KB

.msvcjmc
Size: 3KB - Virtual size: 2KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 35KB - Virtual size: 34KB