2024-06-30_61a91fd5c7263dee33d275e148c2ac21_magniber_poet-rat_ramnit

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-30_61a91fd5c7263dee33d275e148c2ac21_magniber_poet-rat_ramnit
Size

7.0MB
MD5

61a91fd5c7263dee33d275e148c2ac21
SHA1

01b0cd6f83f4dd3e1bfde42b61dd458300deba31
SHA256

06c42ae4f07296f930276bcb954c352ea20ec3ddb756accd1c0b7c57ed6af8ed
SHA512

6dd1fac095165fada5e007dd919278de31546643cb4e7d9c66f2056cc8fe23a5e140d35d2e17b02ed8b8542ab20c851a13b43bf1fc99017f1b20c9abf7f7618c
SSDEEP

98304:nx+y15ZDif5PYXVGx4QjLwAcSjpyZGarJZzDfonvbkZDw3KAGxxmXxZBKFVlX:bbDif5wEx5jBfwGuYUxmxG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-30_61a91fd5c7263dee33d275e148c2ac21_magniber_poet-rat_ramnit

Files

2024-06-30_61a91fd5c7263dee33d275e148c2ac21_magniber_poet-rat_ramnit
.exe windows:5 windows x86 arch:x86

7cd99a7f9bca164d5c7c1b9425231822

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Destroy
ImageList_Add
ImageList_Draw
ImageList_GetImageCount
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIconSize
ord16
ImageList_Create
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Replace
ImageList_SetBkColor

rpcrt4

RpcStringFreeW
UuidToStringW

advapi32

OpenServiceW
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetUserNameW
QueryServiceStatusEx
ControlService
OpenSCManagerW
EnumServicesStatusExW
CloseServiceHandle
RegEnumKeyExA
RegQueryValueExW

wsock32

gethostbyaddr
shutdown
gethostbyname
recvfrom
WSAGetLastError
htons
socket
setsockopt
closesocket
select
recv
send
connect
inet_ntoa
__WSAFDIsSet
getservbyname
sendto

setupapi

SetupDiEnumDeviceInfo
CM_Get_Device_ID_Size
SetupDiOpenDeviceInterfaceRegKey
CM_Get_Parent
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Get_Device_IDW
SetupDiDestroyDeviceInfoList

ws2_32

accept
listen
WSAIoctl
getsockopt
getsockname
getpeername
WSASetLastError
bind
gethostname
ntohs
ntohl
inet_addr
htonl
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo

crypt32

CertFreeCertificateContext

wldap32

ord301
ord143
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord200

iphlpapi

GetIpAddrTable

psapi

EnumProcesses
GetProcessImageFileNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

ReadConsoleOutputCharacterA
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
FreeConsole
WriteConsoleA
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
DebugBreak
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetProcessAffinityMask
GetCurrentProcess
ExitProcess
SetThreadPriority
TerminateThread
GetExitCodeThread
ResumeThread
ReleaseSemaphore
Sleep
GetCommandLineW
TlsGetValue
TlsSetValue
TlsFree
GetFileSize
FindClose
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTempPathW
GetTempFileNameW
GetFileAttributesW
FindFirstFileW
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleW
GetEnvironmentVariableW
GetComputerNameW
IsValidCodePage
GetCPInfo
QueryPerformanceCounter
QueryPerformanceFrequency
GetACP
GetLocaleInfoW
IsValidLocale
SetThreadLocale
GetUserDefaultLCID
GetExitCodeProcess
CreateThread
SetEvent
WaitForMultipleObjects
DuplicateHandle
CreatePipe
SetNamedPipeHandleState
PeekNamedPipe
CreateEventW
CreateProcessW
GetFileType
GetVersionExW
CopyFileW
ExpandEnvironmentStringsW
GetModuleHandleA
GetSystemTimeAsFileTime
RaiseException
GetCurrentThread
FindNextFileW
IsBadReadPtr
IsBadStringPtrA
lstrlenA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetTickCount
SleepEx
GetVersionExA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
FormatMessageA
CompareStringW
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
SwitchToThread
WaitForSingleObjectEx
TryEnterCriticalSection
LocalAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LoadLibraryW
FreeLibrary
GetProcessHeap
HeapSize
GetStdHandle
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SetLastError
GetCurrentThreadId
MulDiv
SizeofResource
LockResource
LoadResource
FindResourceW
DeviceIoControl
WriteFile
ReadFile
CreateFileW
CloseHandle
OpenProcess
QueryDosDeviceW
TerminateProcess
WaitForSingleObject
LocalFree
FormatMessageW
GetLastError
GetVersion
LCMapStringW
GetStringTypeW
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetCurrentDirectoryW
SetErrorMode
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetModuleFileNameA
GetModuleHandleExW
ExitThread
SetStdHandle
DeleteFileW
FlushFileBuffers
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetDriveTypeW
GetFullPathNameW
CreateDirectoryW
MoveFileExW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
EnumSystemLocalesW
HeapReAlloc
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
FindFirstFileExA
FindNextFileA
GetCommandLineA
TlsAlloc

user32

DdeUninitialize
DdeConnect
DdeDisconnect
DdePostAdvise
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeGetLastError
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
RegisterWindowMessageW
CheckMenuItem
DrawEdge
SetMenuItemInfoW
InsertMenuItemW
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetSubMenu
DestroyMenu
CreatePopupMenu
CreateMenu
GetMenuState
GetDialogBaseUnits
DestroyCursor
LoadCursorW
GetClipboardFormatNameW
RegisterClipboardFormatW
DrawIconEx
DrawFrameControl
GetClassNameW
MessageBeep
GetWindowTextLengthW
GetWindowTextW
FindWindowExW
MessageBoxW
GetDoubleClickTime
SetWindowRgn
GetDesktopWindow
SetForegroundWindow
EnableMenuItem
GetSystemMenu
DrawMenuBar
CreateDialogIndirectParamW
IsZoomed
BringWindowToTop
GetWindowPlacement
FlashWindow
UnregisterClassW
RegisterClassW
SetMenu
PostMessageW
LoadImageW
DestroyIcon
LoadIconW
LoadBitmapW
GetIconInfo
IsClipboardFormatAvailable
GetDlgItem
MsgWaitForMultipleObjects
SystemParametersInfoW
GetScrollInfo
DdeInitializeW
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
SetParent
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
InflateRect
FillRect
GetSysColor
ChildWindowFromPointEx
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetWindowRect
GetClientRect
SetWindowTextW
EnableScrollBar
ScrollWindow
RedrawWindow
InvalidateRect
GetUpdateRgn
UpdateWindow
GetMenuItemInfoW
TrackPopupMenu
GetMenuItemCount
GetSystemMetrics
IsWindowEnabled
EnableWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetKeyState
GetFocus
GetActiveWindow
SetFocus
IsWindowVisible
EndDeferWindowPos
MessageBoxA
ValidateRgn
EndPaint
BeginPaint
GetWindowDC
ValidateRect
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
KillTimer
SetTimer
WaitForInputIdle
ShowCursor
AdjustWindowRectEx
wsprintfW
EnumDisplaySettingsW
SetScrollInfo
ChangeDisplaySettingsW
PostThreadMessageW
GetMessageW
DestroyAcceleratorTable
TranslateAcceleratorW
CreateAcceleratorTableW
CreateIconIndirect
ChildWindowFromPoint
SendMessageW
GetDC
ReleaseDC
TranslateMessage
DispatchMessageW
UnionRect
GetClassInfoW
HideCaret
keybd_event
OffsetRect
CopyRect
DrawFocusRect
DrawTextW
CheckMenuRadioItem
SetRect
GetSysColorBrush
CreateDialogParamW
DrawStateW
PeekMessageW
RegisterHotKey
UnregisterHotKey
GetMessagePos
CallWindowProcW
PostQuitMessage
DefWindowProcW
GetMessageTime
IsIconic

gdi32

LineTo
MoveToEx
Arc
CreateSolidBrush
Ellipse
ExtFloodFill
GetBkColor
GetCharABCWidthsW
GetClipBox
GetPixel
GetRegionData
ExtCreateRegion
GetObjectW
GetStockObject
MaskBlt
Pie
PolyPolygon
SetBkColor
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
SetPixel
SetPolyFillMode
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentExPointW
CreateBitmap
BitBlt
GdiFlush
SetBrushOrgEx
StretchBlt
StretchDIBits
SetROP2
SetStretchBltMode
SetTextColor
ExtTextOutW
Polygon
Polyline
PolyBezier
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
CreatePen
ExtCreatePen
CreateHatchBrush
CreatePatternBrush
CreateICW
CreatePalette
SelectPalette
RealizePalette
GetTextExtentPoint32W
OffsetRgn
GetNearestPaletteIndex
GetPaletteEntries
CombineRgn
EqualRgn
GetRgnBox
PtInRegion
RectInRegion
CreateRectRgnIndirect
RestoreDC
SaveDC
SetTextAlign
CreateDIBitmap
GetDIBits
CreateDIBSection
GetDIBColorTable
EnumFontFamiliesExW
SetAbortProc
CreateDCW
StartDocW
EndDoc
StartPage
EndPage
GetSystemPaletteEntries
CloseEnhMetaFile
CreateEnhMetaFileW
DeleteEnhMetaFile
GetEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
ExcludeClipRect
CreateRectRgn
GetTextMetricsW
SelectObject
GetOutlineTextMetricsW
GetDeviceCaps
DeleteObject
Rectangle
CreateFontIndirectW

winspool.drv

ClosePrinter
SetPrinterW
EnumJobsW
OpenPrinterW
EnumPrintersW
DocumentPropertiesW

comdlg32

PageSetupDlgW
PrintDlgW
ChooseFontW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ExtractIconExW
ExtractIconW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW

ole32

OleSetClipboard
RegisterDragDrop
CoLockObjectExternal
OleUninitialize
OleInitialize
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
ReleaseStgMedium
RevokeDragDrop
CoCreateInstance
CoTaskMemAlloc

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 302KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7cd99a7f9bca164d5c7c1b9425231822

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

rpcrt4

advapi32

wsock32

setupapi

ws2_32

crypt32

wldap32

iphlpapi

psapi

version

kernel32

user32

gdi32

winspool.drv

comdlg32

shell32

ole32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 98KB - Virtual size: 306KB

.rsrc Size: 302KB - Virtual size: 302KB

.reloc Size: 392KB - Virtual size: 391KB

.text Size: 160KB - Virtual size: 160KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 98KB - Virtual size: 306KB

.rsrc
Size: 302KB - Virtual size: 302KB

.reloc
Size: 392KB - Virtual size: 391KB

.text
Size: 160KB - Virtual size: 160KB