General

  • Target

    2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch

  • Size

    12.1MB

  • Sample

    240905-pr7dns1hjf

  • MD5

    af1cf0d3fd34dd62caa35769977799ed

  • SHA1

    bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d

  • SHA256

    b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20

  • SHA512

    e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d

  • SSDEEP

    98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7

Malware Config

Targets

    • Target

      2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch

    • Size

      12.1MB

    • MD5

      af1cf0d3fd34dd62caa35769977799ed

    • SHA1

      bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d

    • SHA256

      b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20

    • SHA512

      e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d

    • SSDEEP

      98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

MITRE ATT&CK Matrix

Tasks