PureRAT[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PureRAT.exe
Size 88.1MB
Sample260706-smlsyscx7r
SHA256 f7792cde754de2ec0023d2c4fad3592d394cdaa8ff011f3188989642d9adbaa6
MD5 861b0a24778a0c0b587a908ff89fe267
SHA1 04324dcdf21c8a55ddfd9b8301a53445be6c4aa1
SHA512 1c589fbeafc6e3872986ca0b27fc4eddd0900a4e9a15e6abe7961d5bfca1b9914c7c5ee154ea5ab95558e2bb1eef0507e28556a78bc6295a4a152426251c7c5d
SSDEEP 786432:6K2EMOLMduhIKYpF+eVirw0ZMoln2CKESdukCnk+rkbLDzSU2OTwl1GSwJs3ItlB:yw4FQscIjnfiBebupx7zu2+VKK5rKyV
TLSH
T17A183393E69D20F5C0EAE43C4AB99223F5B07C40172187D729A1BA911F337D76D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PureRAT.exe

File Explorer

PureRAT.exe

.exe 88.1MB

PureRAT.exe

IMPHASH 1e16ad9373403c2313cd74ac5eac9325
SHA256 f7792cde754de2ec0023d2c4fad3592d394cdaa8ff011f3188989642d9adbaa6
MD5 861b0a24778a0c0b587a908ff89fe267
SHA1 04324dcdf21c8a55ddfd9b8301a53445be6c4aa1
SHA512 1c589fbeafc6e3872986ca0b27fc4eddd0900a4e9a15e6abe7961d5bfca1b9914c7c5ee154ea5ab95558e2bb1eef0507e28556a78bc6295a4a152426251c7c5d
SSDEEP 786432:6K2EMOLMduhIKYpF+eVirw0ZMoln2CKESdukCnk+rkbLDzSU2OTwl1GSwJs3ItlB:yw4FQscIjnfiBebupx7zu2+VKK5rKyV
TLSH
T17A183393E69D20F5C0EAE43C4AB99223F5B07C40172187D729A1BA911F337D76D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

451632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetEnvironmentVariableA GetModuleFileNameW lstrcmpiW SetEnvironmentVariableW lstrcatW FreeLibrary lstrlenW LoadLibraryW SetLastError HeapFree GetProcessHeap HeapReAlloc HeapAlloc FindResourceExA GetUserDefaultUILanguage GetPrivateProfileStringW GetLastError GetEnvironmentVariableA CompareStringW SetEvent GetCurrentProcessId CloseHandle WaitForSingleObject CompareStringA WriteFile SetFileTime FormatMessageA lstrcpyW FindFirstFileW FindClose GetSystemTimeAsFileTime CreateFileA ReadFile IsBadReadPtr CreateEventA GetModuleFileNameA SetFilePointer GetModuleHandleW GetCurrentProcess GetWindowsDirectoryA GetVolumeInformationA GetFileAttributesExA GetFullPathNameA FindFirstFileExA FindNextFileA IsWow64Process FlushInstructionCache WriteConsoleW IsBadWritePtr WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetTimeZoneInformation GetStringTypeW GetStringTypeA IsValidCodePage GetOEMCP RtlVirtualUnwind HeapCreate HeapSetInformation GetStdHandle FlsAlloc TlsSetValue GetCurrentThreadId FlsFree TlsFree FlsSetValue FlsGetValue GetCPInfo LCMapStringW LCMapStringA RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader GetStartupInfoW RtlCaptureContext IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ResumeThread ExitThread GetSystemInfo VirtualAlloc GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapDestroy GetVersionExA RaiseException VirtualProtect VirtualQuery lstrcmpiA GetTickCount lstrcpyA WideCharToMultiByte ExitProcess lstrcmpA LoadLibraryA GetProcAddress MultiByteToWideChar Sleep DeleteCriticalSection WaitForMultipleObjects InitializeCriticalSection lstrlenA GetModuleHandleA LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc LockResource LoadResource SizeofResource FindResourceA GetConsoleOutputCP

user32

UnregisterClassA DestroyWindow EndDialog LoadStringA FillRect GetClientRect ReleaseDC SetClassLongA PtInRect SetCursor GetWindowRect LoadCursorA GetWindowLongA SetWindowLongA GetSystemMetrics GetCursorPos GetParent MapWindowPoints GetDesktopWindow SendMessageA SetWindowPos ReleaseCapture SetForegroundWindow PostMessageA BeginPaint GetMessageA TranslateMessage DrawIcon MessageBoxW GetDC DispatchMessageA LoadIconA CreateDialogIndirectParamA SetTimer EndPaint KillTimer PostQuitMessage TrackMouseEvent SetActiveWindow IsDialogMessageA OffsetRect EnableWindow SetWindowLongPtrA LoadImageA GetActiveWindow UpdateWindow AdjustWindowRectEx ScreenToClient GetWindowTextLengthA SetWindowTextA CreateWindowExA RegisterClassExA DefWindowProcA ShowWindow TranslateAcceleratorA SetFocus DrawFocusRect DrawTextA GetWindowTextA SetCapture DrawEdge CallWindowProcA InvalidateRect GetClassNameA GetWindowLongPtrA MessageBoxA wsprintfA

gdi32

CreateSolidBrush CreateCompatibleDC LineTo DeleteDC MoveToEx CreatePen CreateCompatibleBitmap BitBlt SelectObject GetDIBColorTable StretchBlt DeleteObject CreateDIBSection TextOutA GetTextExtentPointA SetBkMode GetStockObject CreateFontIndirectA SetDIBColorTable GetObjectA SetTextColor

advapi32

RegCreateKeyExA RegCloseKey RegQueryValueExA RegSetValueExA RegDeleteValueA

shell32

SHGetFolderPathA

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoCreateInstance

oleaut32

SafeArrayGetUBound GetErrorInfo SafeArrayPutElement SafeArrayDestroy SafeArrayGetElement SafeArrayGetLBound VariantTimeToSystemTime SystemTimeToVariantTime SysFreeString SysStringLen SysAllocString SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear VariantChangeType SysAllocStringLen

gdiplus

GdiplusShutdown GdipDrawImageI GdipDisposeImage GdipAlloc GdiplusStartup GdipFree GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipGetImagePalette GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipCreateBitmapFromStream GdipGetImagePaletteSize

msimg32

AlphaBlend TransparentBlt

iphlpapi

GetAdaptersInfo

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA