rat[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rat.dll
Size

276KB
MD5

ee2b09b7460e2987bd23b35f0746f14b
SHA1

39de87169bbfaf5b3224ed4b7ee9c5a630c9698a
SHA256

503c33ac2cb8022505143f80c75df00dd94e78618de41fdf774752c5563ebff8
SHA512

9ff6dda67759f5e325f04c8f61a936f7e9d534b9b8156be23b36b5c33b55d120d93c97918e16cadd5b60c8c09095ef2bc1dd2381cc882d8ba45259fbb04042fa
SSDEEP

6144:rN+0fPkewI7UpvszNOI9Wvw+4qS18XROh0nGBaEhJwQTGWaVUNI0J+vXx5Z/ZnIZ:qusoh0GqZ3ZnI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.dll

Files

rat.dll
.dll windows:6 windows x64 arch:x64

197fd52bbdcd9c8f99c160d6b5d16658

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\dogon\Desktop\ImGui-DirectX-11-Kiero-Hook-master\x64\Release\ImGui DirectX 11 Kiero Hook.pdb

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
QueryPerformanceFrequency
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
DisableThreadLibraryCalls
CreateThread
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
InitializeSListHead
GlobalUnlock
GlobalLock
QueryPerformanceCounter
GlobalFree
GetThreadContext
GlobalAlloc

user32

DestroyWindow
SetWindowLongPtrA
CallWindowProcA
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
SetClipboardData
GetClipboardData
EmptyClipboard
ClientToScreen
CloseClipboard
OpenClipboard
GetCursorPos
GetForegroundWindow
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
IsChild
SetCapture

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

d3dcompiler_47

D3DCompile

xinput1_4

ord2
ord4

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset
__C_specific_handler
__current_exception_context
strstr
memchr
memcpy
memmove
__std_type_info_destroy_list
__current_exception

api-ms-win-crt-stdio-l1-1-0

fclose
ftell
_wfopen
__stdio_common_vsprintf
fwrite
fflush
__stdio_common_vsscanf
fseek
fread

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_register_onexit_function
_wassert
_initterm_e
_execute_onexit_table
_initterm
_cexit
_crt_atexit
_initialize_narrow_environment
terminate
_seh_filter_dll
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

floorf
fmodf
sinf
ceilf
sqrtf
cosf

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

197fd52bbdcd9c8f99c160d6b5d16658

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

imm32

d3dcompiler_47

xinput1_4

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 194KB - Virtual size: 194KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 11KB - Virtual size: 12KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 120B

.text
Size: 194KB - Virtual size: 194KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 11KB - Virtual size: 12KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 120B