sliver | 2024-12-23_8d641358121125b209b4d86530e47e29_darkbit_poet-rat_sliver | Triage

Sharing

General

Target

2024-12-23_8d641358121125b209b4d86530e47e29_darkbit_poet-rat_sliver
Size

13.1MB
MD5

8d641358121125b209b4d86530e47e29
SHA1

0495d69bbf87f8c10dba9bea67a11f733765bda7
SHA256

8bf0cb7f358f95d9e46ef7ae63cef22d6b190225b7f967a75f64157e39d67fc9
SHA512

815e1bc38c0bb7110e5be29e3eda68715cf41fb732c8a5e3c370aa56b5010b26fd764f1ade2515330356ee755813f17b542e201ce3057998fa1c30bfdd38e591
SSDEEP

98304:r1CQOJHnpmaEEBwAPn7MzsEiM3pCTROaEm87+bbL:r1CQOJHTlzPn7MzsE93pCTROHm8W

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
sample	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-23_8d641358121125b209b4d86530e47e29_darkbit_poet-rat_sliver

Files

2024-12-23_8d641358121125b209b4d86530e47e29_darkbit_poet-rat_sliver
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 723KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ