rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 2.5MB
Sample260722-sy2csacj91
SHA256 ff65438bb24e5773b7204e49f8574d6aa591ac16b36f3cca9460e122c630b1ad
MD5 643030f50de02b3d7a01d705052a5b77
SHA1 241e7f9fa7b45ad73bc7dbbda366e9a48768792d
SHA512 f83ca203c6079520791dcf74e7edd3d798d41e8e39cf871b9ac9529b1a1979951bf06416be3515973a0b5e31377ec0615bcd532370528d35ee21c308ea5866d8
SSDEEP 24576:iLU4/FgmFFxjCPhDIGGVAyiBhpaJeVWGyH:uUAMJDIzVG/kJ+fy
TLSH
T129C5B81BE7B611D2D0BAC13DD553222AFC7134A6833897EBA2C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 2.5MB

rat.exe

IMPHASH a57171a532c5be9d8f5da1a7bd9f2994
SHA256 ff65438bb24e5773b7204e49f8574d6aa591ac16b36f3cca9460e122c630b1ad
MD5 643030f50de02b3d7a01d705052a5b77
SHA1 241e7f9fa7b45ad73bc7dbbda366e9a48768792d
SHA512 f83ca203c6079520791dcf74e7edd3d798d41e8e39cf871b9ac9529b1a1979951bf06416be3515973a0b5e31377ec0615bcd532370528d35ee21c308ea5866d8
SSDEEP 24576:iLU4/FgmFFxjCPhDIGGVAyiBhpaJeVWGyH:uUAMJDIzVG/kJ+fy
TLSH
T129C5B81BE7B611D2D0BAC13DD553222AFC7134A6833897EBA2C58E465B60BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1020020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\rat\build\rat.pdb

kernel32

GetTempPathA GetModuleFileNameA CopyFileA MoveFileExA CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW ExitProcess CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW RtlUnwind

user32

SwapMouseButton

ws2_32

getaddrinfo WSAStartup socket shutdown setsockopt send recv ntohs freeaddrinfo htons htonl getpeername ioctlsocket connect closesocket bind accept WSAGetLastError ntohl inet_ntop listen sendto recvfrom WSACleanup

Name

.textbss

Size

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

372KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

kernel32

user32

ws2_32

generic