Art3misRAT[.]exe

Resubmissions

28-06-2024 08:32

240628-ke9k2szeqd 6

28-06-2024 08:31

240628-ke1yxazepf 10

Sharing

Copy URL

Twitter E-mail

General

Target

Art3misRAT.exe
Size

301KB
MD5

daf31441569e92e3f909dabeda56610a
SHA1

0412ae97d5276c7645ade95219f2b69b05e37e0b
SHA256

b972052ad75f75ec85a5369693ad8ee4bc8bd53f8e4318951bc5777a03da9308
SHA512

aa2d63e3192cda6d31dbc2499f58b7e9581367927143b36437d57c084116dc924f6c4f67eb80fcc0dc4d47b98d447f53dc23e062fc7dd66edd05dc1b849808e4
SSDEEP

6144:VCqO3ok/GGfgVQIsiXu+DwqpTEwJFK8JImAT5yF:nOYk3EEP8rG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Art3misRAT.exe

Files

Art3misRAT.exe
.exe windows:6 windows x64 arch:x64

fb5691e11a8a95bafcecde4e4534b419

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Art3misRAT.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
SystemFunction036
RegSetValueExW
RegCreateKeyExW

kernel32

GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
GetCurrentThreadId
CloseHandle
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetStdHandle
GetCurrentProcessId
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
CreateFileW
CreateEventW
ReadFile
GetOverlappedResult
CancelIo
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
IsProcessorFeaturePresent
WriteConsoleW
CreateThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA

ntdll

RtlNtStatusToDosError
NtWriteFile
NtReadFile

ws2_32

recv
send
WSASocketW
getaddrinfo
connect
closesocket
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError

vcruntime140

__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memmove
memset
memcpy
memcmp
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initterm
_set_app_type
exit
_exit
_get_initial_narrow_environment
_configure_narrow_argv
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initterm_e
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

fb5691e11a8a95bafcecde4e4534b419

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 227KB - Virtual size: 226KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 512B - Virtual size: 792B

.pdata Size: 9KB - Virtual size: 9KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 227KB - Virtual size: 226KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 512B - Virtual size: 792B

.pdata
Size: 9KB - Virtual size: 9KB

.reloc
Size: 1KB - Virtual size: 1KB