rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 2.5MB
Sample260722-w5eddasbla
SHA256 34ca11d694ec60e3b2ff2ac3a0721b4924d49f58c5b4449da9b2444f0642699c
MD5 7eb2912704c7ff233e51361e64cce4d4
SHA1 1c21b7b009705fa6ac7619ca956c8287cd6cfb19
SHA512 f66c18f29788b7ecb688ab48e65a2d6f5db2020a72281e41a1d86c223f9950a48deb7d5290f4dcf7d3ebe10f59c90136b8ea174672bf6fe9ffb064923a62cb39
SSDEEP 24576:jW4oQHxUIDvgffUbj9MYL1G9V3WkIdzMmFreXAduD:j5VDIHUbSYpGD8My4
TLSH
T1F7C5C71BEBB611D1D0BAC139D553222AFC7134A7833897EBA2C59E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 2.5MB

rat.exe

IMPHASH b5cfb2e6d403f271e9dd37aaf135ec78
SHA256 34ca11d694ec60e3b2ff2ac3a0721b4924d49f58c5b4449da9b2444f0642699c
MD5 7eb2912704c7ff233e51361e64cce4d4
SHA1 1c21b7b009705fa6ac7619ca956c8287cd6cfb19
SHA512 f66c18f29788b7ecb688ab48e65a2d6f5db2020a72281e41a1d86c223f9950a48deb7d5290f4dcf7d3ebe10f59c90136b8ea174672bf6fe9ffb064923a62cb39
SSDEEP 24576:jW4oQHxUIDvgffUbj9MYL1G9V3WkIdzMmFreXAduD:j5VDIHUbSYpGD8My4
TLSH
T1F7C5C71BEBB611D1D0BAC139D553222AFC7134A7833897EBA2C59E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1007582

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\rat\build\rat.pdb

ws2_32

freeaddrinfo getaddrinfo shutdown setsockopt ntohs listen getpeername bind accept inet_ntop inet_pton WSAGetLastError closesocket socket send select recv ntohl htons htonl getsockopt ioctlsocket connect WSAStartup

iphlpapi

GetAdaptersAddresses

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation CreateFileW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReadConsoleW RtlVirtualUnwind QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW

Name

.textbss

Size

Virtual Size

961KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

354KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

ws2_32

iphlpapi

kernel32

generic