rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 2.5MB
Sample260722-wwtrpsae79
SHA256 cfa04b62c8c6b3224763753b9d3a5c95d4fe05d62ca7c0f47b3980cec9782207
MD5 69cb1598574d53e59a714e168b557912
SHA1 a42cb61ca210618840949b00d293b82e541306b9
SHA512 0866a11a4829f20d5da18888d5613a15f867ad147f245550811a9ebfea12d91f6fb4b0a284c558376fe21ba5b08cdc40196596afa7634a7759dde5b39a31dd66
SSDEEP 24576:5Bu3QDJwU6s/Mhdk72FptqeMy/Q1pp6a:5RFXM/s2F76
TLSH
T1FCC5C71BEBB611D1D0BAC139D553222AFD7134A7833897EBA2C58E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 2.5MB

rat.exe

IMPHASH 23bf19f8f30468690bc7e896b5bb3e47
SHA256 cfa04b62c8c6b3224763753b9d3a5c95d4fe05d62ca7c0f47b3980cec9782207
MD5 69cb1598574d53e59a714e168b557912
SHA1 a42cb61ca210618840949b00d293b82e541306b9
SHA512 0866a11a4829f20d5da18888d5613a15f867ad147f245550811a9ebfea12d91f6fb4b0a284c558376fe21ba5b08cdc40196596afa7634a7759dde5b39a31dd66
SSDEEP 24576:5Bu3QDJwU6s/Mhdk72FptqeMy/Q1pp6a:5RFXM/s2F76
TLSH
T1FCC5C71BEBB611D1D0BAC139D553222AFD7134A7833897EBA2C58E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1003366

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\rat\build\rat.pdb

ws2_32

ntohl freeaddrinfo getaddrinfo shutdown send recv ntohs listen getpeername ioctlsocket connect bind inet_ntop WSAGetLastError WSAStartup socket setsockopt sendto recvfrom htons htonl closesocket accept

iphlpapi

GetAdaptersAddresses

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetTimeZoneInformation UnhandledExceptionFilter QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

Name

.textbss

Size

Virtual Size

959KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

ws2_32

iphlpapi

kernel32

generic