SecuriteInfo[.]com[.]Win32[.]RATX-gen[.]32303[.]15212[.]exe | Triage

Resubmissions

18-10-2024 20:35

241018-zc7q1axald 10

18-10-2024 20:24

241018-y6plvawflb 10

Sharing

General

Target

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
Size

940KB
MD5

b36366f4a27987d6de47887b03f29c68
SHA1

6f290bd6c132ec5c824558a29bdf75d25ced94e3
SHA256

4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b
SHA512

a9441175872e88fc49482ef4707fad0e1f15a3ee1f4c74f3a2fafd3744968025d35ca61ed1905239a01df58511985e00708cdae7cb9acae4cca8b51032e02359
SSDEEP

24576:q4bDOphvGTO5+L0Un5cOoaPaoWXqEinqg4dNMBlqD9:HD2n+H5cOoUao+vib4rMu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

Files

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
.exe windows:4 windows x86 arch:x86

3a8897c84eb41f36b4bbabcc617408b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

user32

GetWindow

advapi32

RegDeleteKeyA

shell32

SHGetFolderPathW

Sections

.text
Size: 64KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ