2024-08-08_6624795da1dfa221d2d039d3d2bac20c_poet-rat_snatch | Triage

Sharing

General

Target

2024-08-08_6624795da1dfa221d2d039d3d2bac20c_poet-rat_snatch
Size

10.9MB
MD5

6624795da1dfa221d2d039d3d2bac20c
SHA1

22cf110067c25bd27035649df0f7c5ece8893309
SHA256

777067ceb5bf9ba16a55f8a0b5d913fbf4f566e61143ece53c3fa6c5c758f696
SHA512

66f30d6a7ccde05f8d38b42462b91be9473b514376453325ff590889c5c37a1c3e5190f6b58c4f9b90c27d29052175cdca1a9e016c1d1187952f6d8799fbb5d7
SSDEEP

98304:o3WBP9loEChXVFmEiZGZBRA5RACW0Oxg:om9oFxiI/C5CLv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-08_6624795da1dfa221d2d039d3d2bac20c_poet-rat_snatch

Files

2024-08-08_6624795da1dfa221d2d039d3d2bac20c_poet-rat_snatch
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 252KB - Virtual size: 663KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ