Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_afc9647d4602e05eb8c55e6abb9019ad_poet-rat_rex_snatch.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-28_afc9647d4602e05eb8c55e6abb9019ad_poet-rat_rex_snatch.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-28_afc9647d4602e05eb8c55e6abb9019ad_poet-rat_rex_snatch
-
Size
21.5MB
-
MD5
afc9647d4602e05eb8c55e6abb9019ad
-
SHA1
13489de2ab2d86b1ab4c824d69971bfa5819cb83
-
SHA256
678ea1f1d1b10f2575cd9d836cbd7ca6f875b22b37ad2db81186560170336198
-
SHA512
adcc428c7665d209cf6b355608cfcaa4dfc2702bf3ac3f8a7227484740ca11abd543f6b19a247864ffc1aae034a7de314db72350f46bff9f01999e842a2c6d22
-
SSDEEP
98304:y4iipjP5oCFx33PllYaaN9EGuq0EXMlrDbmL4Mzag/Gp0QFnfoY0jSPcjni:ycoiYPR0E0bNMzGW5+
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-28_afc9647d4602e05eb8c55e6abb9019ad_poet-rat_rex_snatch
Files
-
2024-06-28_afc9647d4602e05eb8c55e6abb9019ad_poet-rat_rex_snatch.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12.5MB - Virtual size: 12.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 458KB - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 420KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ