Behavioral task
behavioral1
Sample
2025-03-16_0315e15637439c345cc20eaff1a0ab57_poet-rat_sliver_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-16_0315e15637439c345cc20eaff1a0ab57_poet-rat_sliver_snatch.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-16_0315e15637439c345cc20eaff1a0ab57_poet-rat_sliver_snatch
-
Size
13.0MB
-
MD5
0315e15637439c345cc20eaff1a0ab57
-
SHA1
eac57be3ec841c770de1d840a8f1da6c4f8cea56
-
SHA256
b6c9a4982319f8fa09efbba78ca2a296c7b33e829a943f5fa650245c309f5e0a
-
SHA512
e327d4fa2845d4b683b2d249977dbe4e97795a17f8001a1fc1e4f7bc4f63288b253b25a1cd264ac776c06c2762b4c865fd0f2c62343c60ae4d6f098842fe23fc
-
SSDEEP
196608:GKouOB/7eXB94InJrRx/2Xh0cGf7kz6bIHEvTVPEBBJsu:zIYB9trWh0BOabVPmsu
Malware Config
Signatures
-
NGLite payload 1 IoCs
resource yara_rule sample family_nglite -
Nglite family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-16_0315e15637439c345cc20eaff1a0ab57_poet-rat_sliver_snatch
Files
-
2025-03-16_0315e15637439c345cc20eaff1a0ab57_poet-rat_sliver_snatch.exe windows:6 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 398KB - Virtual size: 548KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 281B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 541KB - Virtual size: 540KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/32 Size: 154KB - Virtual size: 153KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/46 Size: 22KB - Virtual size: 21KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/63 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/80 Size: 512B - Virtual size: 45B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/99 Size: 966KB - Virtual size: 965KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/112 Size: 666KB - Virtual size: 666KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/124 Size: 208KB - Virtual size: 208KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 948B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 882KB - Virtual size: 882KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ