RAT[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RAT.zip
Size

130KB
MD5

80bbadbe0960b21e1d2856b5b80e8ced
SHA1

5e6db3d21ee77ce9976203135e118abe174a4615
SHA256

d6703c36274202afe274bdc78e1905f9ab8aa916af3c6de252fe2351d1586755
SHA512

2032abdbfadb417950973113381fe4abef1457736cdf7509dfe38fb6a448d0e2add2dc22f9d0d71d85ca75b63dddce9263242aa540364452a3f46b5a3cfaf439
SSDEEP

3072:nvA1acE+pC2+a0kdFMRKSBp6DGHRp0VlWTHu5Af4:vAUC3+dgFMhBqAeWf4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RAT

Files

RAT.zip
.zip

Password: infected
RAT
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Exports

Exports

__current_exception
__current_exception_context
_except_handler4_common
memchr
memcpy
memmove
memset
strchr
strrchr
strstr
wcsrchr

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 343B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ