rat spoofer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rat spoofer.exe
Size

1.1MB
MD5

2601c7d889c7ce2c9b3dffe20e4c4b8f
SHA1

73c4411cfa440d94c782714436ae1f73f36f2b3f
SHA256

01b2581b559cc0bfcda80f390370260415044601e51cfce6b3eeb21e7e9e46fb
SHA512

4dedaa88926021c38e049b7f88138dcbbd45b4b08acfb0186ac41ba301b3e3f8e997be484b9e5a97cf1fb2b1c065bdaeaba63c1b062801278a85520f79ccd0fe
SSDEEP

24576:Jb9qMgITMvRFhRRbNWoCfkYSEH3OqtwIuXCJpR:z7gITYbNbNWo4kSH3OqtwI5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat spoofer.exe

Files

rat spoofer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\xtroas\Desktop\lmitp\lmitp\obj\Release\Zytroas Spoofer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 938KB - Virtual size: 938KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ