rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 2.5MB
Sample260722-1btnesce78
SHA256 50418f5e089aba2f9b38be907c27f11c3d36192c52c3337379367916001a80d0
MD5 67878ea4f5e4b792f77d59f9cc93ba54
SHA1 800b5ea2ba2241676f0a1be4895642f635c5bca7
SHA512 d99a12d315ac2ee721d26d0bcc145e441a638a9e4d99ef5ed7ad9ee43a0ff7a70e918ee912d8562ffc776a5a011669b5644d3ce571cb8eb333213f09f6ba3234
SSDEEP 24576:HOezBhiVTMwK21CgskJifQVc2/3N8r5LQetjP:HOewIgskJifaN8Jf7
TLSH
T1F3C5C81BEBB611D1E0BAC139D553222AFC7134A6C33897EB62C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 2.5MB

rat.exe

IMPHASH 436767b46129acf5e85754960dae1ffe
SHA256 50418f5e089aba2f9b38be907c27f11c3d36192c52c3337379367916001a80d0
MD5 67878ea4f5e4b792f77d59f9cc93ba54
SHA1 800b5ea2ba2241676f0a1be4895642f635c5bca7
SHA512 d99a12d315ac2ee721d26d0bcc145e441a638a9e4d99ef5ed7ad9ee43a0ff7a70e918ee912d8562ffc776a5a011669b5644d3ce571cb8eb333213f09f6ba3234
SSDEEP 24576:HOezBhiVTMwK21CgskJifQVc2/3N8r5LQetjP:HOewIgskJifaN8Jf7
TLSH
T1F3C5C81BEBB611D1E0BAC139D553222AFC7134A6C33897EB62C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1011798

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\rat\build\rat.pdb

user32

SwapMouseButton

ws2_32

shutdown setsockopt ntohs listen getpeername bind accept inet_ntop inet_pton WSAGetLastError freeaddrinfo socket send select recv ntohl htons htonl getsockopt ioctlsocket connect closesocket getaddrinfo WSAStartup

iphlpapi

GetAdaptersAddresses

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW CreateFileW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW ReadFile RtlLookupFunctionEntry QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlUnwind RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW ExitProcess CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW

Name

.textbss

Size

Virtual Size

966KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

361KB

Virtual Size

361KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

user32

ws2_32

iphlpapi

kernel32

generic