Static task
static1
Behavioral task
behavioral1
Sample
2024-06-27_9d9adac05b39a53dc1208ed04d9835a5_poet-rat_snatch.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-27_9d9adac05b39a53dc1208ed04d9835a5_poet-rat_snatch.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-27_9d9adac05b39a53dc1208ed04d9835a5_poet-rat_snatch
-
Size
17.9MB
-
MD5
9d9adac05b39a53dc1208ed04d9835a5
-
SHA1
b705dd335fde047476fde9945d383402c8bde7f9
-
SHA256
75dda683c5cded611c4dd1e358f60712a5de6d9bacdfd1c40ea234ad4140be24
-
SHA512
ca4def6a092393900f9afd61da99a0ff4aca97257f7b51a8310bac86ad10e9b0fd5ca2178751cf5a967f2ec4e72806969e52fbb047d31023083fd0f7c53a9627
-
SSDEEP
393216:yTHh+iPnF3FeEHYlCFauSq+hb3DEpS+KIPLnSDUFOjOyGm8:w3EE4laN+93uJLnSDUF1yGm8
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-27_9d9adac05b39a53dc1208ed04d9835a5_poet-rat_snatch
Files
-
2024-06-27_9d9adac05b39a53dc1208ed04d9835a5_poet-rat_snatch.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
XXXA Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
YYYB Size: 17.9MB - Virtual size: 17.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE