2024-10-09_bd3276f7c667e772f92d97167f9e5d87_poet-rat_snatch | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-09_bd3276f7c667e772f92d97167f9e5d87_poet-rat_snatch
Size

5.2MB
MD5

bd3276f7c667e772f92d97167f9e5d87
SHA1

1bdff73a82495cebb765edaa50d456b3dba81faa
SHA256

edcc25205022d22f5b3dea9ef4a2e1068edacc9fb9ad358dd5fd2d3501b5f9c3
SHA512

a48a41cef2100942758fa2a59af763552718bc544b82908fd10fd67574890d0d0a9e35844284343f529678b46384796385a3162dd5e381658b71f758add02258
SSDEEP

49152:sDwtrbv3pHLMT0rb/T6vO90dL3BmAFd4A64nsfJSWH7WoGOC13niV5R1b+MKFQNt:K63LN3zfFIKEZ3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-09_bd3276f7c667e772f92d97167f9e5d87_poet-rat_snatch

Files

2024-10-09_bd3276f7c667e772f92d97167f9e5d87_poet-rat_snatch
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 251KB - Virtual size: 637KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ