2024-08-07_be4ec51da261f8de5c9bd25f461aa91b_hijackloader_poet-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-07_be4ec51da261f8de5c9bd25f461aa91b_hijackloader_poet-rat_snatch
Size

37.1MB
MD5

be4ec51da261f8de5c9bd25f461aa91b
SHA1

3644dacf5ade444417aa1038ee532b6097fee172
SHA256

e551df12342aeef3fc345bbef13d85e1289c18c1f6b7dd85246207f838b57b4b
SHA512

f32ad447542aeaa4df4c799422d4195e6231cdfda308566aa69822ee1a81a998885b812b6ade194757007d1b1af344f1261a651d52cba56c86e645872e1f3482
SSDEEP

393216:KTghdxW5vp3RBw1Ou1orRN5Ijt3Zdp1uPGiSPWw1J2:Gtp3zYOtmj5fp1uVS+w1w

Score

1^/10

Malware Config

Signatures

Files

2024-08-07_be4ec51da261f8de5c9bd25f461aa91b_hijackloader_poet-rat_snatch
.exe windows:6 windows x64 arch:x64

7f8926befb7c6fd91ccd76cfa440758d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:82:72:3f:2a:01:c3:c2:78:0e:ce:7b:85:03:64:a5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

06/07/2023, 00:00

Not After

05/07/2024, 23:59

Subject

CN=长沙卓擎电子商务有限公司,O=长沙卓擎电子商务有限公司,L=长沙市,ST=湖南省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:6e:26:28:87:de:28:00:46:5d:1d:28:9c:19:8b:a8:b1:2d:33:48:94:4d:c9:da:f5:70:8a:73:13:52:6a:ef
Signer

Actual PE Digest

5f:6e:26:28:87:de:28:00:46:5d:1d:28:9c:19:8b:a8:b1:2d:33:48:94:4d:c9:da:f5:70:8a:73:13:52:6a:ef

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

opengl32

wglGetProcAddress

user32

WindowFromPoint
WaitMessage
UnregisterDeviceNotification
UnregisterClassW
TranslateMessage
TrackMouseEvent
ToUnicode
SystemParametersInfoW
ShowWindow
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetRect
SetPropW
SetLayeredWindowAttributes
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SendMessageW
ScreenToClient
RemovePropW
ReleaseDC
ReleaseCapture
RegisterRawInputDevices
RegisterDeviceNotificationW
RegisterClassExW
PtInRect
PostMessageW
PeekMessageW
OpenClipboard
OffsetRect
MsgWaitForMultipleObjects
MoveWindow
MonitorFromWindow
MessageBoxW
MapVirtualKeyW
LoadImageW
LoadCursorW
IsZoomed
IsWindowVisible
IsIconic
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetSystemMetrics
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetRawInputData
GetPropW
GetMonitorInfoW
GetMessageTime
GetLayeredWindowAttributes
GetKeyState
GetDC
GetCursorPos
GetClipboardData
GetClientRect
GetClassLongPtrW
GetActiveWindow
FlashWindow
EnumDisplaySettingsW
EnumDisplaySettingsExW
EnumDisplayMonitors
EnumDisplayDevicesW
EmptyClipboard
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
CreateWindowExW
CreateIconIndirect
CloseClipboard
ClipCursor
ClientToScreen
ChangeDisplaySettingsExW
BringWindowToTop
AdjustWindowRectEx

shell32

DragQueryPoint
DragQueryFileW
DragFinish
DragAcceptFiles

msvcrt

_beginthread
wcscpy
wcscmp
strtoul
strtol
strtok
strstr
strspn
strncpy
strncmp
strlen
strcspn
strcpy
strcmp
sscanf
sprintf
realloc
raise
qsort
memset
memmove
memcpy
malloc
fwrite
fwprintf
free
fprintf
calloc
abort
_vsnprintf
_snwprintf
_exit
_errno
__setusermatherr
__iob_func

gdi32

SwapBuffers
SetPixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
GetDeviceCaps
DescribePixelFormat
DeleteObject
DeleteDC
CreateRectRgn
CreateDIBSection
CreateDCW
CreateBitmap
ChoosePixelFormat

kernel32

WaitForSingleObject
SetEvent
CreateEventA
WideCharToMultiByte
VerSetConditionMask
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
Sleep
SetThreadExecutionState
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetLastError
FreeLibrary
FormatMessageW
EnterCriticalSection
DeleteCriticalSection
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
Sleep
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Exports

Exports

_cgo_panic
_cgo_topofstack
crosscall2
glowDebugCallback_gl21
goCharCB
goCharModsCB
goCursorEnterCB
goCursorPosCB
goDropCB
goErrorCB
goFramebufferSizeCB
goJoystickCB
goKeyCB
goMonitorCB
goMouseButtonCB
goScrollCB
goWindowCloseCB
goWindowContentScaleCB
goWindowFocusCB
goWindowIconifyCB
goWindowMaximizeCB
goWindowPosCB
goWindowRefreshCB
goWindowSizeCB

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21.1MB - Virtual size: 21.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9.4MB - Virtual size: 9.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f8926befb7c6fd91ccd76cfa440758d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:82:72:3f:2a:01:c3:c2:78:0e:ce:7b:85:03:64:a5Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5f:6e:26:28:87:de:28:00:46:5d:1d:28:9c:19:8b:a8:b1:2d:33:48:94:4d:c9:da:f5:70:8a:73:13:52:6a:efSigner

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

user32

shell32

msvcrt

gdi32

kernel32

Exports

Exports

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 21.1MB - Virtual size: 21.1MB

.data Size: 9.4MB - Virtual size: 9.9MB

.idata Size: 5KB - Virtual size: 5KB

.edata Size: 1024B - Virtual size: 700B

.reloc Size: 269KB - Virtual size: 268KB

.symtab Size: 512B - Virtual size: 4B

.rsrc Size: 114KB - Virtual size: 113KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:82:72:3f:2a:01:c3:c2:78:0e:ce:7b:85:03:64:a5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5f:6e:26:28:87:de:28:00:46:5d:1d:28:9c:19:8b:a8:b1:2d:33:48:94:4d:c9:da:f5:70:8a:73:13:52:6a:ef
Signer

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 21.1MB - Virtual size: 21.1MB

.data
Size: 9.4MB - Virtual size: 9.9MB

.idata
Size: 5KB - Virtual size: 5KB

.edata
Size: 1024B - Virtual size: 700B

.reloc
Size: 269KB - Virtual size: 268KB

.symtab
Size: 512B - Virtual size: 4B

.rsrc
Size: 114KB - Virtual size: 113KB