Behavioral task
behavioral1
Sample
2025-03-30_92389243320c12f5f312fdd630e1ef6b_poet-rat_snatch.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-30_92389243320c12f5f312fdd630e1ef6b_poet-rat_snatch.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-30_92389243320c12f5f312fdd630e1ef6b_poet-rat_snatch
-
Size
11.5MB
-
MD5
92389243320c12f5f312fdd630e1ef6b
-
SHA1
3c33c51d3f62ffdf6d33b309af1b92ab75099be3
-
SHA256
353873fe8c946c5c20e803b311621180988fc9220ec53d56707769bab9eae034
-
SHA512
335a9d451393af71329288795e3b89800ddcdd75db92ec24714f5da740d6d058a1ea6e03a8219930f070762132df3b83d7047b5ef2a65b7905218e91e96bb240
-
SSDEEP
98304:KfP0vxbA0oMBna4UO2U4XvRPspyaYSitOCTwFlde56xqK:xfo3Zu
Malware Config
Signatures
-
Detect SalatStealer payload 1 IoCs
resource yara_rule sample family_salatstealer -
Salatstealer family
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-30_92389243320c12f5f312fdd630e1ef6b_poet-rat_snatch
Files
-
2025-03-30_92389243320c12f5f312fdd630e1ef6b_poet-rat_snatch.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE