2024-09-12_0864f6770bc77298e4681f9d591e22dd_hijackloader_poet-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-12_0864f6770bc77298e4681f9d591e22dd_hijackloader_poet-rat_snatch
Size

28.7MB
MD5

0864f6770bc77298e4681f9d591e22dd
SHA1

70b91aaa47a5655794b475b8f8a5bf572301e7ac
SHA256

5a7b49aed988ac834f5535608a49bfc6b031a57b66525c7c13f92f1acd488496
SHA512

68600920b9577f598e6b943eb66d6ed3adde4918a868b27f32aa4684cb5d25e47231881d3e316a4cf614ced498a9614603a043d9f1cc510775f5b0c866a4e3dd
SSDEEP

393216:+nXFOp/4AXug77qs6aC6kjsbtWAC8/oEX6pYPv:+nXFOpwA7eaC6EuoAC8/NUYP

Score

1^/10

Malware Config

Signatures

Files

2024-09-12_0864f6770bc77298e4681f9d591e22dd_hijackloader_poet-rat_snatch
.exe windows:6 windows x86 arch:x86

35885b45c38e8262882eb2afc102293b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:ad
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19/08/2021, 00:00

Not After

18/11/2024, 23:59

Subject

CN=Anton Diesel,O=Anton Diesel,ST=Kemerovskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:ad
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19/08/2021, 00:00

Not After

18/11/2024, 23:59

Subject

CN=Anton Diesel,O=Anton Diesel,ST=Kemerovskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:37:67:1e:e0:aa:07:c3:9c:98:32:4b:84:2c:64:41:cd:26:4a:04:e3:b0:62:f7:53:de:27:0f:bf:42:14:a4
Signer

Actual PE Digest

0a:37:67:1e:e0:aa:07:c3:9c:98:32:4b:84:2c:64:41:cd:26:4a:04:e3:b0:62:f7:53:de:27:0f:bf:42:14:a4

Digest Algorithm

sha256

PE Digest Matches

false

21:0d:04:20:41:2c:19:36:01:02:dc:72:13:b0:db:e0:f7:eb:66:13
Signer

Actual PE Digest

21:0d:04:20:41:2c:19:36:01:02:dc:72:13:b0:db:e0:f7:eb:66:13

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile

Sections

mlGVF2Ns
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

pzc4mAMS
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Gdt3YKIM
Size: 225KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

uiiAXjNi
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

yowoHhXC
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

AlA6UqFz
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ

k7iyGnfE
Size: 11.2MB - Virtual size: 11.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

o9GzACpx
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CzVUuG3g
Size: 10.3MB - Virtual size: 10.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

gfVhPBsv
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

C1KH7sWw
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35885b45c38e8262882eb2afc102293b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:adCertificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:adCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0a:37:67:1e:e0:aa:07:c3:9c:98:32:4b:84:2c:64:41:cd:26:4a:04:e3:b0:62:f7:53:de:27:0f:bf:42:14:a4Signer

21:0d:04:20:41:2c:19:36:01:02:dc:72:13:b0:db:e0:f7:eb:66:13Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

mlGVF2Ns Size: 2.5MB - Virtual size: 2.5MB

pzc4mAMS Size: 2.2MB - Virtual size: 2.2MB

Gdt3YKIM Size: 225KB - Virtual size: 514KB

uiiAXjNi Size: 1KB - Virtual size: 1KB

yowoHhXC Size: 111KB - Virtual size: 111KB

AlA6UqFz Size: 512B - Virtual size: 4B

k7iyGnfE Size: 11.2MB - Virtual size: 11.2MB

o9GzACpx Size: 512B - Virtual size: 32B

CzVUuG3g Size: 10.3MB - Virtual size: 10.3MB

gfVhPBsv Size: 57KB - Virtual size: 56KB

C1KH7sWw Size: 120KB - Virtual size: 119KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:ad
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

36:0a:ef:c1:53:e8:df:88:7f:84:68:2b:3c:86:9a:ad
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0a:37:67:1e:e0:aa:07:c3:9c:98:32:4b:84:2c:64:41:cd:26:4a:04:e3:b0:62:f7:53:de:27:0f:bf:42:14:a4
Signer

21:0d:04:20:41:2c:19:36:01:02:dc:72:13:b0:db:e0:f7:eb:66:13
Signer

mlGVF2Ns
Size: 2.5MB - Virtual size: 2.5MB

pzc4mAMS
Size: 2.2MB - Virtual size: 2.2MB

Gdt3YKIM
Size: 225KB - Virtual size: 514KB

uiiAXjNi
Size: 1KB - Virtual size: 1KB

yowoHhXC
Size: 111KB - Virtual size: 111KB

AlA6UqFz
Size: 512B - Virtual size: 4B

k7iyGnfE
Size: 11.2MB - Virtual size: 11.2MB

o9GzACpx
Size: 512B - Virtual size: 32B

CzVUuG3g
Size: 10.3MB - Virtual size: 10.3MB

gfVhPBsv
Size: 57KB - Virtual size: 56KB

C1KH7sWw
Size: 120KB - Virtual size: 119KB