General
-
Target
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch
-
Size
12.1MB
-
Sample
240905-pr7dns1hjf
-
MD5
af1cf0d3fd34dd62caa35769977799ed
-
SHA1
bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d
-
SHA256
b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20
-
SHA512
e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d
-
SSDEEP
98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
2024-09-05_af1cf0d3fd34dd62caa35769977799ed_poet-rat_snatch
-
Size
12.1MB
-
MD5
af1cf0d3fd34dd62caa35769977799ed
-
SHA1
bbc3a5d43c05a716fd0ae9d7653a7955b999cf0d
-
SHA256
b3234c030e2baf3ef512e0f847188aa65f0dd0f705cccd0820fa56c0130fca20
-
SHA512
e5f56bea3cc849fe2b5788d3440fea3e52088280e2808ca1c648e539c2354d353066fc1183a6897218af9f09625ca9309e5994daec75a94dd13f79b96597352d
-
SSDEEP
98304:mHjD4g7VTdunZIIe/PTaKT45n4tEG4Y2HDEDeblvVAoOb7u:Y7VTdSe/PT14R4+GxebnAoOb7
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-