poolrat | f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b.bin
Size 284KB
Sample251104-s8dz8scv5f
SHA256 f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b
MD5 6ee7db15e452bda0f3dfb6ff396ac18d
SHA1 d5da3de09d64487c84a452c966fbdc81cdf5ab2d
SHA512 e4ec8aa71742567b85d00a8d0ecf62f9b66bd8799a330328755403aebdf6869c133da90a9afb0f95decb6ea282449aab26d82169588ce633600a67dc0a5f00ab
SSDEEP 6144:jrvLYHi3W09Wf0HK7e/aEXWqiJyCo3reNtqATBkQHPBN:j7L+iG3CK7vEmq3CtqATGQf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

poolrat

Malware Config

Signatures

Detects Windows variant of PoolRAT 1 IoCs

resource	yara_rule
sample	family_poolrat

Poolrat family
poolrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b.bin

File Explorer

f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b.bin

.dll 284KB

f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b.bin

IMPHASH e83eed5de95f7cdf1691cf06ab0d3b19
SHA256 f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b
MD5 6ee7db15e452bda0f3dfb6ff396ac18d
SHA1 d5da3de09d64487c84a452c966fbdc81cdf5ab2d
SHA512 e4ec8aa71742567b85d00a8d0ecf62f9b66bd8799a330328755403aebdf6869c133da90a9afb0f95decb6ea282449aab26d82169588ce633600a67dc0a5f00ab
SSDEEP 6144:jrvLYHi3W09Wf0HK7e/aEXWqiJyCo3reNtqATBkQHPBN:j7L+iG3CK7vEmq3CtqATGQf
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Windows variant of PoolRAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA CloseHandle CreateThread GetCurrentDirectoryW GetProcAddress FreeLibrary MultiByteToWideChar CreateFileW DeleteFileW MoveFileExW GetCurrentThread GetFileTime GetFileType ReadFile SetFilePointerEx WriteFile GetTickCount LocalFree GetLastError GetFileSizeEx GetModuleHandleA WriteConsoleW HeapSize SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation HeapReAlloc GetStringTypeW GetACP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA WideCharToMultiByte HeapFree HeapAlloc CompareStringW LCMapStringW GetStdHandle

user32

wsprintfW

advapi32

CreateProcessAsUserW GetSecurityInfo

shell32

CommandLineToArgvW

ws2_32

setsockopt ioctlsocket htons connect socket inet_addr select gethostbyname closesocket

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptDeriveKeyPBKDF2