General
-
Target
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch
-
Size
12.1MB
-
Sample
240905-pr7dns1hjf
-
MD5
af1cf0d3fd34dd62caa35769977799ed
-
SHA1
bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d
-
SHA256
b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20
-
SHA512
e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d
-
SSDEEP
98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch
-
Size
12.1MB
-
MD5
af1cf0d3fd34dd62caa35769977799ed
-
SHA1
bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d
-
SHA256
b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20
-
SHA512
e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d
-
SSDEEP
98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4