2024-08-08_55909e4b2fddb243f5129a3b90d3aade_poet-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-08_55909e4b2fddb243f5129a3b90d3aade_poet-rat_snatch
Size

6.7MB
MD5

55909e4b2fddb243f5129a3b90d3aade
SHA1

cf2ab8e344abb57aa68711eb53e1095821c3263c
SHA256

b35d3596b953915c65efaadab49b46a46036dc9bb33c9b8032a6e4f566e8e844
SHA512

db62344e3070d129321c4120bf30a8b0d1d41cc04f7b5690c3c77c49a5ef572d5a0393e5101d6cfe633fece7a42c6a647b500c6f8afdb79f1c74100bddf68dad
SSDEEP

98304:GUM3xvjIlsaZn+e1XlXFoRAxoS1ElCTKYl4:GUM3Z85+exoYoSWl0N4

Score

1^/10

Malware Config

Signatures

Files

2024-08-08_55909e4b2fddb243f5129a3b90d3aade_poet-rat_snatch
.exe windows:4 windows x86 arch:x86

96c44fa1eee2c4e9b9e77d7bf42d59e6

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cb
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/10/2021, 16:14

Not After

26/10/2024, 16:14

Subject

SERIALNUMBER=08345597,CN=Electronic Team\, Inc.,O=Electronic Team\, Inc.,STREET=901 N Pitt St Ste 101,L=Alexandria,ST=Virginia,C=US,1.2.840.113549.1.9.1=#0c15737570706f727440656c656374726f6e69632e7573,1.3.6.1.4.1.311.60.2.1.2=#130856697267696e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cb
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/10/2021, 16:14

Not After

26/10/2024, 16:14

Subject

SERIALNUMBER=08345597,CN=Electronic Team\, Inc.,O=Electronic Team\, Inc.,STREET=901 N Pitt St Ste 101,L=Alexandria,ST=Virginia,C=US,1.2.840.113549.1.9.1=#0c15737570706f727440656c656374726f6e69632e7573,1.3.6.1.4.1.311.60.2.1.2=#130856697267696e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:1c:59:18:67:44:be:99:df:45:3d:dd:c7:39:50:9c:6d:aa:c1:d9:c8:7e:9d:03:06:a2:7d:b2:dc:c9:45:bf
Signer

Actual PE Digest

a4:1c:59:18:67:44:be:99:df:45:3d:dd:c7:39:50:9c:6d:aa:c1:d9:c8:7e:9d:03:06:a2:7d:b2:dc:c9:45:bf

Digest Algorithm

sha256

PE Digest Matches

false

27:39:2b:8c:a7:0b:5c:56:61:96:de:7b:13:67:7e:64:9d:37:bc:89
Signer

Actual PE Digest

27:39:2b:8c:a7:0b:5c:56:61:96:de:7b:13:67:7e:64:9d:37:bc:89

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

winmm

timeEndPeriod
timeBeginPeriod

ws2_32

WSAGetOverlappedResult

kernel32

WriteFile
WriteConsoleW
WaitForSingleObject
VirtualFree
VirtualAlloc
SwitchToThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
LoadLibraryA
LoadLibraryW
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 188KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 437B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/18
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/30
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/43
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/59
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/75
Size: 512B - Virtual size: 42B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/94
Size: 1009KB - Virtual size: 1009KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/106
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.symtab
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96c44fa1eee2c4e9b9e77d7bf42d59e6

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cbCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cbCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

a4:1c:59:18:67:44:be:99:df:45:3d:dd:c7:39:50:9c:6d:aa:c1:d9:c8:7e:9d:03:06:a2:7d:b2:dc:c9:45:bfSigner

27:39:2b:8c:a7:0b:5c:56:61:96:de:7b:13:67:7e:64:9d:37:bc:89Signer

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.data Size: 188KB - Virtual size: 272KB

/4 Size: 512B - Virtual size: 437B

/18 Size: 200KB - Virtual size: 199KB

/30 Size: 158KB - Virtual size: 157KB

/43 Size: 82KB - Virtual size: 81KB

/59 Size: 142KB - Virtual size: 141KB

/75 Size: 512B - Virtual size: 42B

/94 Size: 1009KB - Virtual size: 1009KB

/106 Size: 47KB - Virtual size: 47KB

.idata Size: 1024B - Virtual size: 882B

.symtab Size: 332KB - Virtual size: 332KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cb
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

3b:f5:6a:3a:41:0b:d0:27:f7:f4:cd:cb
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

a4:1c:59:18:67:44:be:99:df:45:3d:dd:c7:39:50:9c:6d:aa:c1:d9:c8:7e:9d:03:06:a2:7d:b2:dc:c9:45:bf
Signer

27:39:2b:8c:a7:0b:5c:56:61:96:de:7b:13:67:7e:64:9d:37:bc:89
Signer

.text
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 188KB - Virtual size: 272KB

/4
Size: 512B - Virtual size: 437B

/18
Size: 200KB - Virtual size: 199KB

/30
Size: 158KB - Virtual size: 157KB

/43
Size: 82KB - Virtual size: 81KB

/59
Size: 142KB - Virtual size: 141KB

/75
Size: 512B - Virtual size: 42B

/94
Size: 1009KB - Virtual size: 1009KB

/106
Size: 47KB - Virtual size: 47KB

.idata
Size: 1024B - Virtual size: 882B

.symtab
Size: 332KB - Virtual size: 332KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB