2024-08-20_e0a85229ba070b47442e343d818465ee_poet-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-20_e0a85229ba070b47442e343d818465ee_poet-rat_snatch
Size

27.1MB
MD5

e0a85229ba070b47442e343d818465ee
SHA1

8bebfd56f31e8a0e5dcd7a34179f35f5cf4c6c5f
SHA256

a4fba17182b5013ec4757e8378c1b4dc16442c1c10a4141fa7e9af1a59c08f0b
SHA512

1cb9131d60215aef9002de40849ab320d91062d84efa6f931a82ec81516043eadc6d4e5d5166b43af6f0b50fc3fdb5a5e72097dfd534efe6ae20f20a1da486c8
SSDEEP

393216:smKISA3cltwTc5OVnBPr4pNw7430IXV9mTS6WPqXF:smhSp2ToOVhWNwM30Il9m+6IqXF

Score

1^/10

Malware Config

Signatures

Files

2024-08-20_e0a85229ba070b47442e343d818465ee_poet-rat_snatch
.exe windows:6 windows x86 arch:x86

35885b45c38e8262882eb2afc102293b

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c7:1a:a4:a6:79:b7:bd:c2:ea:43:65:4b:37:3a:e8:9f:cf:ce:86:5a:b0:fb:32:7e:9d:40:6c:26:25:5f:95:b3
Signer

Actual PE Digest

c7:1a:a4:a6:79:b7:bd:c2:ea:43:65:4b:37:3a:e8:9f:cf:ce:86:5a:b0:fb:32:7e:9d:40:6c:26:25:5f:95:b3

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile

Sections

+[7>DB
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

6K;
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UI$$=
Size: 225KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IB'
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

,"<QC=
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

S.7AR[
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ

Y83,P
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

2.\HI
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

?E:1ZJ
Size: 10.2MB - Virtual size: 10.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

W["9J
Size: 647KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

)@+3&=
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35885b45c38e8262882eb2afc102293b

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5eCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

c7:1a:a4:a6:79:b7:bd:c2:ea:43:65:4b:37:3a:e8:9f:cf:ce:86:5a:b0:fb:32:7e:9d:40:6c:26:25:5f:95:b3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

+[7>DB Size: 2.5MB - Virtual size: 2.5MB

6K; Size: 2.2MB - Virtual size: 2.2MB

UI$$= Size: 225KB - Virtual size: 514KB

IB' Size: 1KB - Virtual size: 1KB

,"<QC= Size: 111KB - Virtual size: 111KB

S.7AR[ Size: 512B - Virtual size: 4B

Y83,P Size: 11.1MB - Virtual size: 11.1MB

2.\HI Size: 512B - Virtual size: 32B

?E:1ZJ Size: 10.2MB - Virtual size: 10.2MB

W["9J Size: 647KB - Virtual size: 646KB

)@+3&= Size: 120KB - Virtual size: 119KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c7:1a:a4:a6:79:b7:bd:c2:ea:43:65:4b:37:3a:e8:9f:cf:ce:86:5a:b0:fb:32:7e:9d:40:6c:26:25:5f:95:b3
Signer

+[7>DB
Size: 2.5MB - Virtual size: 2.5MB

6K;
Size: 2.2MB - Virtual size: 2.2MB

UI$$=
Size: 225KB - Virtual size: 514KB

IB'
Size: 1KB - Virtual size: 1KB

,"<QC=
Size: 111KB - Virtual size: 111KB

S.7AR[
Size: 512B - Virtual size: 4B

Y83,P
Size: 11.1MB - Virtual size: 11.1MB

2.\HI
Size: 512B - Virtual size: 32B

?E:1ZJ
Size: 10.2MB - Virtual size: 10.2MB

W["9J
Size: 647KB - Virtual size: 646KB

)@+3&=
Size: 120KB - Virtual size: 119KB