RAT[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RAT.exe
Size

6KB
MD5

f51718a985d5ae3493fdfaf80d8a8197
SHA1

2a7bac30455e44683bb4e777b852b8c049fbaa30
SHA256

3e0032b0e03aa04f668e880c2b80704a956676e5bb3fecc2c39d45cdb1066542
SHA512

0ef54253fa6463a2a7fc0661d4037a8ab0c23207a4ead1e4d0b27a6b65be836cdee7ea32e542e7b70e2b4b40a2de04fac6c618417524c33b2d2714f01a970a69
SSDEEP

48:6Sy+AJSY+rxaoKaNM8+DknbWvBp9lkdXKEMus5LfupcQdjGV1XquA/it1/lPIfrB:4l6IG+DknEe6sjpTjGV1XZdIaBzNt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RAT.exe

Files

RAT.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\rgerm\source\repos\RAT\RAT\obj\Debug\RAT.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ