General
-
Target
natrats.exe
-
Size
54KB
-
MD5
5b85e2261616aecfb837d2b895dba85b
-
SHA1
7ee6ec33364282984ce724285964487e565e9477
-
SHA256
6beae713063f270fdddc3af0ca5c61dd1876327f9d7aef9cd91b0ddec375d138
-
SHA512
f7a19f393b5efe8f524dae1a4ef6b48bd17e9ecfaec0a2369d62c8db15b1a947db09c678022abbdb488306a726495cd7a06960626a23b06df56f59a39cdd88a5
-
SSDEEP
768:15KDaoBKh3Z5Z7GxpQvynRtkiGz14HU/kbp9/aA62MI+wv6WOUhL4Hw:zfTT7Ggvy7Na4H4kbpFavG+g6WOUOQ
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource natrats.exe
Files
-
natrats.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ