Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_48667d0bf92ec8eb90045aaccb4fa65a_cobalt-strike_poet-rat_sliver_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-30_48667d0bf92ec8eb90045aaccb4fa65a_cobalt-strike_poet-rat_sliver_snatch.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-30_48667d0bf92ec8eb90045aaccb4fa65a_cobalt-strike_poet-rat_sliver_snatch
-
Size
9.8MB
-
MD5
48667d0bf92ec8eb90045aaccb4fa65a
-
SHA1
7a3c1967556b8a8eb00a982fe3a6797f12219023
-
SHA256
561904f7b07ff182cd9e15ff15567341644a4756bb50854cafe9ce8192d5fda6
-
SHA512
acc29e23bfa633aa0e20cd0e6a6df58f30bfe4d6a7ad2d8970bce90bcd7ac89be8bb3062c7146b7e8773ad365263ec5a206a8e01c8468fcbedfb86ebc7fdf646
-
SSDEEP
196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRbhR2hRn:DAkLRLRxRYRtRiRn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-30_48667d0bf92ec8eb90045aaccb4fa65a_cobalt-strike_poet-rat_sliver_snatch
Files
-
2025-03-30_48667d0bf92ec8eb90045aaccb4fa65a_cobalt-strike_poet-rat_sliver_snatch.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 205KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 914B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ