rat[.]exe | Triage™

Resubmissions

12/08/2026, 15:50

260812-tabmwszgjg3

12/08/2026, 15:27

260812-svsapsxyf13

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 14.0MB
Sample260812-svsapsxyf1
SHA256 9a905df3ddea7236a398c887ab0943cda9f6ec1e9ea3680491e48626e2c8e317
MD5 0c9ab1465bf31b73da0fd5e270302282
SHA1 8f4cdd4d8d61729d9151cf35ad798ff64f3239fc
SHA512 47204b12abf7812ed1c793650a2717ae0f1c4638e0619f8219b6730e4bee14d348e8f902814feaaeb0ff665cf6a4bb53e76a005e8555a2c0cc4e8897dd9e62e9
SSDEEP 196608:gsJL5nDka9t7hwWmj/Db0FqOCDgzssF23V9l:geLH/7qEqOC0G3VP
TLSH
T155E64C4777874DE6CCC62BB4B9AB233D9730ED319E690B2BA54C91341C532DCAD1AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 14.0MB

rat.exe

IMPHASH e5bb9389e59c33a36b1ecb9636767ec7
SHA256 9a905df3ddea7236a398c887ab0943cda9f6ec1e9ea3680491e48626e2c8e317
MD5 0c9ab1465bf31b73da0fd5e270302282
SHA1 8f4cdd4d8d61729d9151cf35ad798ff64f3239fc
SHA512 47204b12abf7812ed1c793650a2717ae0f1c4638e0619f8219b6730e4bee14d348e8f902814feaaeb0ff665cf6a4bb53e76a005e8555a2c0cc4e8897dd9e62e9
SSDEEP 196608:gsJL5nDka9t7hwWmj/Db0FqOCDgzssF23V9l:geLH/7qEqOC0G3VP
TLSH
T155E64C4777874DE6CCC62BB4B9AB233D9730ED319E690B2BA54C91341C532DCAD1AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfig2W CheckTokenMembership CloseServiceHandle CreateServiceW CryptAcquireContextW CryptDestroyKey CryptEncrypt CryptExportKey CryptGenKey CryptImportKey CryptReleaseContext CryptSetKeyParam FreeSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW RegCloseKey RegCreateKeyExW RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegSetValueExW

crypt32

CryptUnprotectData

d3d9

Direct3DCreate9

dbghelp

MiniDumpWriteDump

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDIBits GetStockObject SelectObject

gdiplus

GdiplusShutdown GdiplusStartup

iphlpapi

GetAdaptersInfo

kernel32

Beep CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentVariableW GetFileSize GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetFilePointer SetFirmwareEnvironmentVariableA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

mfplat

MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromURL

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func fwprintf __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _setjmp _time64 _unlock _vscprintf _vsnprintf _wcmdln _wcsicmp _wcstoui64 _wfopen _wtoi abort atexit calloc exit fclose fflush fopen fprintf fputc fputs fputwc free fwrite getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strerror strftime strlen strncmp strstr strtoul strxfrm system towlower towupper vfprintf wcscoll wcscpy wcsftime wcslen wcsstr wcsxfrm _write _strdup _read _fileno _fdopen

ole32

CLSIDFromString CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize

oleaut32

OleLoadPicturePath

shell32

ShellExecuteW

shlwapi

PathFileExistsW PathFindFileNameW

urlmon

URLDownloadToFileW

user32

CallNextHookEx ChangeDisplaySettingsW CloseClipboard CreateWindowExW DestroyWindow EmptyClipboard EnumDisplaySettingsW ExitWindowsEx FillRect FindWindowW GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetKeyboardLayout GetKeyboardState GetLastInputInfo GetSystemMetrics MessageBoxW OpenClipboard ReleaseDC SetClipboardData SetLayeredWindowAttributes SetWindowTextW SetWindowsHookExW ToUnicodeEx UnhookWindowsHookEx

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA

winmm

waveOutSetVolume

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanGetProfile WlanGetProfileList WlanOpenHandle

ws2_32

InetPtonW WSAStartup accept bind closesocket connect htons listen send sendto setsockopt socket

Name

.text

Size

973KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

344KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

advapi32

crypt32

d3d9

dbghelp

gdi32

gdiplus

iphlpapi

kernel32

mfplat

mfreadwrite

msvcrt

ole32

oleaut32

shell32

shlwapi

urlmon

user32

winhttp

wininet

winmm

wlanapi

ws2_32

generic