Behavioral task
behavioral1
Sample
2024-09-30_aa3df439dadd11f353603a666b95a6e5_poet-rat_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-30_aa3df439dadd11f353603a666b95a6e5_poet-rat_snatch.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-30_aa3df439dadd11f353603a666b95a6e5_poet-rat_snatch
-
Size
37.2MB
-
MD5
aa3df439dadd11f353603a666b95a6e5
-
SHA1
671f2ca654ca9a1cb833882862eef9d11a0c5b18
-
SHA256
f366b797a3036423303cce42afb58ed460175ee82d8839868cf55eef49487c50
-
SHA512
9e6f89765001acf76b4443303a43a801c0518a0123dad4b81b0ea366d8669f274b15d49feb5e847870eacfeb91c41486a1a6d879f912822afbf730f843e973e1
-
SSDEEP
196608:nJZQiz970vFrxuqLmDfdhZuHvDadi1KIrklV7vPXMpm:JZQi570vPmboPDadLvP
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-30_aa3df439dadd11f353603a666b95a6e5_poet-rat_snatch
Files
-
2024-09-30_aa3df439dadd11f353603a666b95a6e5_poet-rat_snatch.exe windows:6 windows x64 arch:x64
0c1e0b4890cc87424a0fd0132621e9be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
ExitProcess
GetProcAddress
Sections
UPX0 Size: 26.6MB - Virtual size: 26.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SCY Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE