SecuriteInfo[.]com[.]BackDoor[.]Rat[.]281[.]18292[.]12946

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.BackDoor.Rat.281.18292.12946
Size 1.4MB
Sample240418-krfthagd74
SHA256 7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
MD5 793707365df26450bc8642f518a540f0
SHA1 66649127ad784288c393992971a197c10f86a8eb
SHA512 550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
SSDEEP 24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.BackDoor.Rat.281.18292.12946

File Explorer

SecuriteInfo.com.BackDoor.Rat.281.18292.12946

.exe 1.4MB

SecuriteInfo.com.BackDoor.Rat.281.18292.12946

IMPHASH 019647f8a1eb3148b0e2b8be3fbd329b
SHA256 7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
MD5 793707365df26450bc8642f518a540f0
SHA1 66649127ad784288c393992971a197c10f86a8eb
SHA512 550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
SSDEEP 24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

EqualSid InitializeAcl OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegEnumKeyExW RegOpenKeyA RegOpenKeyExA RegQueryValueA RegQueryValueExA RegRestoreKeyA RegSetValueExA

kernel32

CloseHandle CompareStringA CreateEventA CreateFileA CreateMutexA CreateNamedPipeA CreateThread DeleteCriticalSection EnterCriticalSection EnumCalendarInfoA ExitProcess FatalAppExitA FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FindResourceA FormatMessageA FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCurrentDirectoryA GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetEnvironmentStrings GetFileSize GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetSystemInfo GetSystemTime GetThreadLocale GetTickCount GetVersion GetVersionExA GlobalAddAtomA GlobalAlloc GlobalDeleteAtom GlobalFindAtomA GlobalFree GlobalHandle GlobalLock GlobalMemoryStatus GlobalReAlloc GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadResource LocalAlloc LocalFree LockResource MulDiv MultiByteToWideChar OpenEventW OpenFileMappingA RaiseException ReadFile ReleaseMutex ResetEvent RtlUnwind SearchPathA SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetSystemTime SetThreadLocale SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteFileEx lstrcmpA lstrcpyA lstrcpynA lstrlenA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIconSize ImageList_GetImageCount ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_SetIconSize ImageList_Write ord17

gdi32

Arc BitBlt CombineRgn CopyEnhMetaFileA CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateDIBitmap CreateFontIndirectA CreateHalftonePalette CreatePalette CreatePenIndirect CreatePolygonRgn CreateRectRgn CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject Ellipse EnumFontsA ExcludeClipRect ExtCreatePen ExtSelectClipRgn ExtTextOutA GetBitmapBits GetBkColor GetBkMode GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetNearestColor GetObjectA GetPaletteEntries GetPixel GetRgnBox GetStockObject GetSystemPaletteEntries GetTextAlign GetTextExtentPoint32A GetTextExtentPointA GetTextMetricsA GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LPtoDP LineTo MaskBlt MoveToEx PatBlt Pie PlayEnhMetaFile PolyPolyline Polygon Polyline RealizePalette RectVisible Rectangle RestoreDC RoundRect SaveDC SelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetEnhMetaFileBits SetMapMode SetPixel SetROP2 SetStretchBltMode SetTextAlign SetTextColor SetViewportExtEx SetViewportOrgEx SetWinMetaFileBits SetWindowExtEx SetWindowOrgEx StretchBlt TextOutA UnrealizeObject

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint CallNextHookEx CallWindowProcA CharLowerA CharLowerBuffA CharNextA CharToOemA CharToOemBuffA CharUpperBuffA CheckMenuItem ChildWindowFromPoint ClientToScreen CloseClipboard CreateIcon CreateMenu CreatePopupMenu CreateWindowExA DefFrameProcA DefMDIChildProcA DefWindowProcA DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextA EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndPaint EnumClipboardFormats EnumThreadWindows EnumWindows EqualRect FillRect FindWindowA FrameRect GetActiveWindow GetCapture GetCaretPos GetClassInfoA GetClassNameA GetClientRect GetClipboardData GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextA GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetKeyboardType GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuState GetMenuStringA GetMessagePos GetMessageTime GetParent GetPropA GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemA IntersectRect InvalidateRect IsCharAlphaA IsCharAlphaNumericA IsChild IsDialogMessageA IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadBitmapA LoadCursorA LoadIconA LoadKeyboardLayoutA LoadStringA MapVirtualKeyA MapWindowPoints MessageBeep MessageBoxA OemToCharA OemToCharBuffA OffsetRect OpenClipboard PeekMessageA PostMessageA PostQuitMessage PtInRect RedrawWindow RegisterClassA RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu RemovePropA ScreenToClient ScrollWindow ScrollWindowEx SendMessageA SetActiveWindow SetCapture SetClassLongA SetClipboardData SetCursor SetFocus SetForegroundWindow SetKeyboardState SetMenu SetMenuItemInfoA SetParent SetPropA SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowTextA SetWindowsHookExA ShowCursor ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoA TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnionRect UnregisterClassA UpdateWindow ValidateRect WaitMessage WinHelpA WindowFromPoint wsprintfA GetSysColor

ole32

CLSIDFromString CoCreateInstance CoGetClassObject CoInitialize CoTaskMemFree CoUninitialize IsEqualGUID StringFromCLSID

oleaut32

CreateErrorInfo GetErrorInfo SafeArrayAccessData SafeArrayCopy SafeArrayCreate SafeArrayDestroy SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArrayUnaccessData SetErrorInfo SysAllocStringLen SysFreeString SysReAllocStringLen VarBoolFromStr VarBstrFromBool VarBstrFromCy VarBstrFromDate VarCyFromStr VarDateFromStr VarI4FromStr VarNeg VarNot VarR8FromStr VariantChangeTypeEx VariantClear VariantCopy VariantCopyInd VariantInit

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

53KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

86KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.BackDoor.Rat.281.18292.12946

advapi32

kernel32

version

comctl32

gdi32

user32

ole32

oleaut32

generic