General
-
Target
2024-10-10_7a71d68fd14c17c55210f369432be07e_poet-rat_snatch
-
Size
13.1MB
-
Sample
241010-mecbnateje
-
MD5
7a71d68fd14c17c55210f369432be07e
-
SHA1
c68a576117c091a2317c41cc903daff80930b15c
-
SHA256
a67a14776f7f9fa4ccd2ce0507416ec2c2d1a343db5076ad0828377edeba56b4
-
SHA512
9b4784b05adb20fdaf1bdf52749a642da771d42ea2697427664926f39979992027629f42f33d5f1aac2eb41070bbe03c69898de073e02836aa71ea6b953cc710
-
SSDEEP
49152:d0xR25+ptZlJD8DPh1WXkDEnO0qJojtnUVgbsCmhlZqPCsIN76CyD1qCQjZrjOXt:CxR25srCjWZULHU6sTvFVh
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_7a71d68fd14c17c55210f369432be07e_poet-rat_snatch.exe
Resource
win7-20241010-en
Malware Config
Extracted
stealc
mainteam
http://95.182.96.50
-
url_path
/2aced82320799c96.php
Targets
-
-
Target
2024-10-10_7a71d68fd14c17c55210f369432be07e_poet-rat_snatch
-
Size
13.1MB
-
MD5
7a71d68fd14c17c55210f369432be07e
-
SHA1
c68a576117c091a2317c41cc903daff80930b15c
-
SHA256
a67a14776f7f9fa4ccd2ce0507416ec2c2d1a343db5076ad0828377edeba56b4
-
SHA512
9b4784b05adb20fdaf1bdf52749a642da771d42ea2697427664926f39979992027629f42f33d5f1aac2eb41070bbe03c69898de073e02836aa71ea6b953cc710
-
SSDEEP
49152:d0xR25+ptZlJD8DPh1WXkDEnO0qJojtnUVgbsCmhlZqPCsIN76CyD1qCQjZrjOXt:CxR25srCjWZULHU6sTvFVh
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-