2024-08-25_08145fcc7f533e4da979b9b53c78770f_megazord_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-25_08145fcc7f533e4da979b9b53c78770f_megazord_poet-rat
Size

17.2MB
MD5

08145fcc7f533e4da979b9b53c78770f
SHA1

8be0c64b0dce27ae970befc7abb98e8cb3e37dc9
SHA256

e45c25cdcdfff2d964723d53404e2d92246fb3ae3881f4f5e40dd2f18fc61df9
SHA512

b477554a89df227d445f7244741ff781a39c123247269c09935bc8853d9036796c57587b9e39c9ac686e86d7196f683c421b2e10fd8bc23834341744f5fa84c2
SSDEEP

196608:oTc8ElB9RMqVLf+rFohpQagwsscbDl3NVl2L/:owHL3MNaXQUsxbDl3NXo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-25_08145fcc7f533e4da979b9b53c78770f_megazord_poet-rat

Files

2024-08-25_08145fcc7f533e4da979b9b53c78770f_megazord_poet-rat
.exe windows:6 windows x64 arch:x64

0b5e17c87711f5fd0f8acc98123aa5c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

/build/agent/bin/win-x64native/Ews.Agent.pdb

Imports

advapi32

AdjustTokenPrivileges
ChangeServiceConfig2W
CheckTokenMembership
CloseServiceHandle
ControlService
CreateServiceW
CreateWellKnownSid
DeleteService
DuplicateTokenEx
EnumerateTraceGuidsEx
EventActivityIdControl
EventEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteTransfer
GetTokenInformation
GetWindowsAccountDomainSid
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceConfigW
QueryServiceStatus
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerExW
RevertToSelf
SetServiceStatus
SetThreadToken
StartServiceCtrlDispatcherW
StartServiceW

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptExportKey
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty

crypt32

CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertCloseStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW
CertOpenStore
CertSaveStore
CertSerializeCertificateStoreElement
CertSetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertVerifyTimeValidity
CryptDecodeObject
CryptFindOIDInfo
CryptFormatObject
CryptImportPublicKeyInfoEx2
CryptMsgClose
CryptMsgGetParam
CryptQueryObject
PFXExportCertStore
PFXImportCertStore

iphlpapi

GetAdaptersAddresses
GetNetworkParams
GetPerAdapterInfo
if_nametoindex

kernel32

AddVectoredExceptionHandler
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CompareStringEx
CompareStringOrdinal
ConnectNamedPipe
CreateDirectoryW
CreateEventExW
CreateEventW
CreateFileA
CreateFileW
CreateIoCompletionPort
CreateMutexExW
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DebugBreak
DecodePointer
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumCalendarInfoExEx
EnumTimeFormatsEx
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNLSStringEx
FindStringOrdinal
FlsAlloc
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDynamicTimeZoneInformation
GetEnabledXStateFeatures
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLargePageMinimum
GetLastError
GetLocaleInfoEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaProcessorNodeEx
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessGroupAffinity
GetProcessHeap
GetProcessId
GetProcessTimes
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimes
GetThreadContext
GetThreadIdealProcessorEx
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
GetUserPreferredUILanguages
GlobalMemoryStatusEx
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
InitializeConditionVariable
InitializeContext
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessInJob
IsProcessorFeaturePresent
K32EnumProcesses
K32GetProcessMemoryInfo
LCMapStringEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LocaleNameToLCID
MoveFileExW
MultiByteToWideChar
OpenProcess
OpenThread
QueryFullProcessImageNameW
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseException
RaiseFailFastException
ReadConsoleW
ReadDirectoryChangesW
ReadFile
ReleaseMutex
ResetEvent
ResolveLocaleName
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadAffinityMask
SetThreadContext
SetThreadErrorMode
SetThreadGroupAffinity
SetThreadIdealProcessorEx
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
SetUnhandledExceptionFilter
SetXStateFeaturesMask
Sleep
SleepConditionVariableCS
SleepEx
StartThreadpoolIo
SubmitThreadpoolWork
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
VirtualAlloc
VirtualAllocExNuma
VirtualFree
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

ncrypt

NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptImportKey
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSetProperty

ole32

CoCreateGuid
CoGetApartmentType
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles

user32

LoadStringW

ws2_32

FreeAddrInfoExW
FreeAddrInfoW
GetAddrInfoExW
GetAddrInfoW
GetNameInfoW
WSACleanup
WSAConnect
WSAEventSelect
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSASend
WSASocketW
WSAStartup
bind
closesocket
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
select
send
setsockopt
shutdown

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil
cos
floor
fmod
log
modf
nan
pow
sin
sqrt
tan

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
isspace
memset
strcmp
strcpy_s
strncpy_s
strtok_s
wcsncmp

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___wargv
_c_exit
_cexit
_configure_wide_argv
_crt_atexit
_errno
_exit
_get_initial_wide_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_set_fmode
fflush

api-ms-win-crt-convert-l1-1-0

strtoul
strtoull

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 671KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.managed
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 281B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b5e17c87711f5fd0f8acc98123aa5c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

user32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 915KB - Virtual size: 915KB

.rdata Size: 6.8MB - Virtual size: 6.8MB

.data Size: 67KB - Virtual size: 315KB

.pdata Size: 671KB - Virtual size: 671KB

.00cfg Size: 512B - Virtual size: 56B

.managed Size: 8.7MB - Virtual size: 8.7MB

.tls Size: 512B - Virtual size: 281B

_RDATA Size: 512B - Virtual size: 500B

hydrated Size: - Virtual size: 4.1MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 915KB - Virtual size: 915KB

.rdata
Size: 6.8MB - Virtual size: 6.8MB

.data
Size: 67KB - Virtual size: 315KB

.pdata
Size: 671KB - Virtual size: 671KB

.00cfg
Size: 512B - Virtual size: 56B

.managed
Size: 8.7MB - Virtual size: 8.7MB

.tls
Size: 512B - Virtual size: 281B

_RDATA
Size: 512B - Virtual size: 500B

hydrated
Size: - Virtual size: 4.1MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB