Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-25_6bbf3073f5cece9e1b479ccca6d9de87_cobalt-strike_poet-rat_sliver_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-25_6bbf3073f5cece9e1b479ccca6d9de87_cobalt-strike_poet-rat_sliver_snatch.exe
Resource
win10v2004-20250313-en
General
-
Target
2025-03-25_6bbf3073f5cece9e1b479ccca6d9de87_cobalt-strike_poet-rat_sliver_snatch
-
Size
11.2MB
-
MD5
6bbf3073f5cece9e1b479ccca6d9de87
-
SHA1
c8d845999ea97e0870ce9a7c4d570abab9a7da68
-
SHA256
4da4934eba79460fc7e4884910e2c6d97c076285797e699e77da4dd0e33871a5
-
SHA512
2993d60fe21c154b25f8ab9cb4e1554d8f950dda61939c72311a5dc1a004414c77c1b246b76a82377733478061fa9a99c14b07ff3b250c838e6a3af5a8d45003
-
SSDEEP
196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhROhR5hRghRrhRZ:DAkLRLRxRtRqRzRcR9RZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-25_6bbf3073f5cece9e1b479ccca6d9de87_cobalt-strike_poet-rat_sliver_snatch
Files
-
2025-03-25_6bbf3073f5cece9e1b479ccca6d9de87_cobalt-strike_poet-rat_sliver_snatch.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 205KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 914B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ