2024-08-06_c0251f4523b6ea8c222b0417febfa32a_poet-rat_snatch | Triage

Sharing

General

Target

2024-08-06_c0251f4523b6ea8c222b0417febfa32a_poet-rat_snatch
Size

8.1MB
MD5

c0251f4523b6ea8c222b0417febfa32a
SHA1

1dfd32803ba37328de22e0455b946526cac64acd
SHA256

27965a6076ffe5961356cf08ff3d477586a598c03c934d2198654aea3f983458
SHA512

bd1b871c07f7e51e9d39728dc32c90459dd1b816b1f7a42eb30af9d1761482227d98d7b250ffdefae84d87a4135a4d256937627b4b9b51863ef065bc43c01938
SSDEEP

98304:YLYYS0WMQNQz9V/jbOBX0fn+w0j/iASSPaFS2QprjpAI:Q5oC/IE/+dj/iALyF4pH

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-06_c0251f4523b6ea8c222b0417febfa32a_poet-rat_snatch

Files

2024-08-06_c0251f4523b6ea8c222b0417febfa32a_poet-rat_snatch
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE