sloppyrat | hostfxr[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
hostfxr.dll
Size 1.6MB
Sample260924-pg3mqsdg36
SHA256 cb313835fab15db0dde6556156d17f277d1a7520d85e23e510af71532a1c52bb
MD5 b2d2b0ddfb26c7fc23d58c97d73b7080
SHA1 3816ffaa4d2a68d3041ee8372d6af27a45ea043a
SHA512 b1ee29a0edbf411497be06a0971a19c9b03b6e8804c66eab59dac077d1b9e187078edf841081e744360cad31aa7583f7bcd84f4ec5e4f69e3b6f56f266bb24a2
SSDEEP 24576:NUKZ5b/uWKjQ/4/siNxDiQrmmMjrFok53lK/xt:NFTzYU/4NrV6W+Ux
TLSH
T126759E03E21B44B8C116C534C1A7A631A9B0BD9E46347D6F1B91EB331E62B90DE7B739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat sloppyrat

Malware Config

Signatures

Family: SloppyRat
SloppyRat is a Windows RAT written in C++.
rat sloppyrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hostfxr.dll

File Explorer

hostfxr.dll

.dll 1.6MB

hostfxr.dll

IMPHASH ba6cfaff23830353a5edbe2c05ba04f3
SHA256 cb313835fab15db0dde6556156d17f277d1a7520d85e23e510af71532a1c52bb
MD5 b2d2b0ddfb26c7fc23d58c97d73b7080
SHA1 3816ffaa4d2a68d3041ee8372d6af27a45ea043a
SHA512 b1ee29a0edbf411497be06a0971a19c9b03b6e8804c66eab59dac077d1b9e187078edf841081e744360cad31aa7583f7bcd84f4ec5e4f69e3b6f56f266bb24a2
SSDEEP 24576:NUKZ5b/uWKjQ/4/siNxDiQrmmMjrFok53lK/xt:NFTzYU/4NrV6W+Ux
TLSH
T126759E03E21B44B8C116C534C1A7A631A9B0BD9E46347D6F1B91EB331E62B90DE7B739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameA GetUserNameW RegCloseKey RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryA

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AttachConsole CloseHandle ConnectNamedPipe CreateDirectoryW CreateFileW CreateNamedPipeW CreatePipe CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisableThreadLibraryCalls DisconnectNamedPipe EnterCriticalSection ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetComputerNameA GetComputerNameExW GetComputerNameW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetLocalTime GetLogicalDriveStringsW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemTime GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetTempPathA GetTempPathW GetThreadId GetTickCount GetTickCount64 GetVersionExA GetVolumeInformationW GetWindowsDirectoryA GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeProcThreadAttributeList InitializeSRWLock IsProcessorFeaturePresent K32EnumProcesses LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile MoveFileW MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter RaiseException ReadFile ReleaseSRWLockExclusive RemoveVectoredExceptionHandler ResumeThread SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetHandleInformation SetNamedPipeHandleState SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiA lstrlenA

api-ms-win-crt-convert-l1-1-0

_wtoi atoi btowc mbrtowc strtol strtoul wcrtomb wctob

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_waccess _fstat64

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr wcsrchr

api-ms-win-crt-runtime-l1-1-0

_errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vswprintf_s _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _wfopen fclose fflush fopen fputc fputs fputwc fread freopen fwrite getc getwc putc putwc setvbuf ungetc ungetwc _write _read _fileno

api-ms-win-crt-string-l1-1-0

iswalnum iswctype iswspace memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscmp wcscoll wcscpy_s wcslen wcsncpy_s wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect freeaddrinfo getaddrinfo getsockopt inet_ntop ioctlsocket recv select send setsockopt shutdown socket

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hostfxr.dll

advapi32

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ws2_32

generic