rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 2.5MB
Sample260722-sxt73stzf1
SHA256 63d45944c1ab6b588d9885f463452a07cf5f0fb0f7465a51906b1574d801a3a9
MD5 5ef6e74f489d3118bc9dc954e3aae4f7
SHA1 c775c4d4b79108af89ef874297f17cf36b06730b
SHA512 173ff6d20cab8b87f418379cb0d37bd7a669b17ea5a9261c580279a63c682da5f5bab64e7acb8020492b724e953e983c30904002ebdc497b8bac809b3467c1a1
SSDEEP 24576:5LCD/Fg+8HxjC4hDIGGVAyiBhpaJe8ROqh:1Cr3iDIzVG/kJ/gq
TLSH
T1D7C5B81BE7B611D2D0BAC13DD553222AFC7134A6833897EBA2C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 2.5MB

rat.exe

IMPHASH a57171a532c5be9d8f5da1a7bd9f2994
SHA256 63d45944c1ab6b588d9885f463452a07cf5f0fb0f7465a51906b1574d801a3a9
MD5 5ef6e74f489d3118bc9dc954e3aae4f7
SHA1 c775c4d4b79108af89ef874297f17cf36b06730b
SHA512 173ff6d20cab8b87f418379cb0d37bd7a669b17ea5a9261c580279a63c682da5f5bab64e7acb8020492b724e953e983c30904002ebdc497b8bac809b3467c1a1
SSDEEP 24576:5LCD/Fg+8HxjC4hDIGGVAyiBhpaJe8ROqh:1Cr3iDIzVG/kJ/gq
TLSH
T1D7C5B81BE7B611D2D0BAC13DD553222AFC7134A6833897EBA2C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1020020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\rat\build\rat.pdb

kernel32

GetTempPathA GetModuleFileNameA CopyFileA MoveFileExA CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW ExitProcess CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW RtlUnwind

user32

SwapMouseButton

ws2_32

getaddrinfo WSAStartup socket shutdown setsockopt send recv ntohs freeaddrinfo htons htonl getpeername ioctlsocket connect closesocket bind accept WSAGetLastError ntohl inet_ntop listen sendto recvfrom WSACleanup

Name

.textbss

Size

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

372KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

kernel32

user32

ws2_32

generic