sliver | 2024-12-27_095b439c05ed6342dd0b3edf1b5fe423_darkbit_poet-rat_sliver | Triage

Sharing

General

Target

2024-12-27_095b439c05ed6342dd0b3edf1b5fe423_darkbit_poet-rat_sliver
Size

15.0MB
MD5

095b439c05ed6342dd0b3edf1b5fe423
SHA1

d0b23f83ba3eacc9671c5a3bc68d28411cdb72c4
SHA256

ae2da9186bc75a7e97f91694d1e85e0e9281f0e9faa45eb50302869b1d334ef9
SHA512

06e50b1632918f0e1e53bfbfb72c0d152cea89453d58d0e171ae4e9c6e0005e38f2a61e8ab2903d86f918b4cbaebd33fcfde4b73e1c3703e48dc7abffeaa940c
SSDEEP

98304:r1CQOJHnpmaEEBwAPn7MzsEiM3pCTROaEm87+bbuNl:r1CQOJHTlzPn7MzsE93pCTROHm8z

Score

10^/10

sliver

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
sample	SliverRAT_v2

Sliver family
sliver

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-27_095b439c05ed6342dd0b3edf1b5fe423_darkbit_poet-rat_sliver

Files

2024-12-27_095b439c05ed6342dd0b3edf1b5fe423_darkbit_poet-rat_sliver
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 723KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ