tigerrat | f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c

Sharing

Copy URL Twitter E-mail

General

Target
f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
Size 246KB
Sample240410-sag91aca29
SHA256 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
MD5 505262547f8879249794fc31eea41fc6
SHA1 b312dd587e8725edf782e0c176b902fbbfc01468
SHA512 68e8acf5d310f763182ea484efa196e35ce8e0665e697a82c6d171d4d0a3fb5ccd3f3a01e22a1219341e9e4a1ade626d7a98e36385b09f07b585b09ab228eba3
SSDEEP 6144:HIfB+z77AzsX/7yqTJ2nnCo4Up9BSqjGXsgxH:HS4ozq/7ENBA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tigerrat

Malware Config

Signatures

Detects TigerRAT payload 1 IoCs

resource	yara_rule
sample	family_tigerrat

Tigerrat family
tigerrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c

File Explorer

f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c

.exe 246KB

f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c

IMPHASH 82fb39e3cccd7598249f660492cabe4c
SHA256 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
MD5 505262547f8879249794fc31eea41fc6
SHA1 b312dd587e8725edf782e0c176b902fbbfc01468
SHA512 68e8acf5d310f763182ea484efa196e35ce8e0665e697a82c6d171d4d0a3fb5ccd3f3a01e22a1219341e9e4a1ade626d7a98e36385b09f07b585b09ab228eba3
SSDEEP 6144:HIfB+z77AzsX/7yqTJ2nnCo4Up9BSqjGXsgxH:HS4ozq/7ENBA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects TigerRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SystemTimeToFileTime GetTickCount WriteFile WideCharToMultiByte FileTimeToSystemTime ReadFile CreateFileW GetLocalTime CloseHandle GetFileInformationByHandle MultiByteToWideChar GetCurrentDirectoryW GetProcAddress LoadLibraryA CreateThread WaitForSingleObject InitializeCriticalSection ExitProcess GetModuleHandleA GetCurrentProcess GetLastError FindFirstFileW UnmapViewOfFile GetModuleHandleW Sleep LeaveCriticalSection GlobalUnlock GetTempPathW EnterCriticalSection DeleteFileW TerminateThread SetEndOfFile WriteConsoleW FlushFileBuffers SetStdHandle GetStringTypeW SetFilePointerEx GetConsoleMode GetConsoleCP OutputDebugStringW LCMapStringW HeapReAlloc SetFilePointer GlobalLock GetFileSize FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA GetFileType GetCPInfo GetOEMCP GetACP IsValidCodePage LoadLibraryExW ReadConsoleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer HeapFree HeapAlloc GetModuleHandleExW AreFileApisANSI GetCommandLineA RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx HeapSize IsProcessorFeaturePresent SetLastError GetCurrentThreadId GetProcessHeap GetStdHandle GetModuleFileNameW IsDebuggerPresent DeleteCriticalSection RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

GetWindowTextA GetDesktopWindow DispatchMessageW UnhookWindowsHookEx OpenClipboard SetWindowsHookExW PeekMessageW GetClipboardData TranslateMessage CallNextHookEx GetKeyState MapVirtualKeyW CloseClipboard VkKeyScanW keybd_event GetForegroundWindow

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

ws2_32

closesocket send listen inet_ntoa socket recv shutdown htons WSAGetLastError htonl inet_addr connect bind accept

gdiplus

GdipSaveImageToStream GdipFree GdipAlloc GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipCloneImage