RatClient[.]exe | Triage

Sharing

General

Target

RatClient.exe
Size

39KB
MD5

535183e6c2778357f5380a900e22a48e
SHA1

9a93b202f921fb8e8b477bf812befc5d74e2eab2
SHA256

161ac2f439eae6165af8090e8b6a1ca2180e16038af766a9337eb668cf134cab
SHA512

1b4aa4c83d89b112cbd813bc94bd1fa2bb99e76437d6b31f64fe5026d4a9ecc44125dcb6fecd417daa5a71869f774edafae81b96c65a93e538d11d04234ebb71
SSDEEP

768:wvhux8CPRPWROIfQpxybMGUOkKL2fA86TUg5WVTYdai6JuC:0O8CPNrI64opXZiUgo6EZb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RatClient.exe

Files

RatClient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ