rattity[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rattity.exe
Size 487KB
Sample260930-nnbl6aeb73
SHA256 d791ff606eda98d75710721a81390c070caa92d20ff8dbfb72791ab5369a7a34
MD5 028224e5f285a9e2247d33721b7d0b81
SHA1 d80d8205d06b7203853554e8d514458505331c20
SHA512 c089f392d30780f117b473705a0ade380f34d74a8e341629a6b91edc71ea2a4a437e4c14885641fcd8b1b9534c758dc8bd4e05fdcef8a5b08d2db2dfea79b76c
SSDEEP 6144:K2A5tBDYBig4BIu7iv1iqqdoxko2MCde7b8uyvetqpxgxCa8p0:2Qaau7idi4VqqxVtqpxYCa
TLSH
T13AB48E6AA79806F9E0B7C17DCE438902E771784907B1A7DF07E04AB61E276E14D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rattity.exe

File Explorer

rattity.exe

.exe 487KB

rattity.exe

IMPHASH 19e7df5ae57004c014220fd183f6eb88
SHA256 d791ff606eda98d75710721a81390c070caa92d20ff8dbfb72791ab5369a7a34
MD5 028224e5f285a9e2247d33721b7d0b81
SHA1 d80d8205d06b7203853554e8d514458505331c20
SHA512 c089f392d30780f117b473705a0ade380f34d74a8e341629a6b91edc71ea2a4a437e4c14885641fcd8b1b9534c758dc8bd4e05fdcef8a5b08d2db2dfea79b76c
SSDEEP 6144:K2A5tBDYBig4BIu7iv1iqqdoxko2MCde7b8uyvetqpxgxCa8p0:2Qaau7idi4VqqxVtqpxYCa
TLSH
T13AB48E6AA79806F9E0B7C17DCE438902E771784907B1A7DF07E04AB61E276E14D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

crypt32

CryptStringToBinaryA

gdiplus

GdiplusStartup GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject DeleteDC

ole32

CoCreateInstance CoInitializeEx

user32

TranslateMessage CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ReleaseDC GetDC GetSystemMetrics MapVirtualKeyA GetKeyNameTextA GetAsyncKeyState GetClipboardData CloseClipboard OpenClipboard ShowWindow PostThreadMessageA DispatchMessageA GetMessageA

shell32

SHGetFolderPathW

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW GetUserNameA

iphlpapi

GetAdaptersInfo

kernel32

IsValidCodePage HeapReAlloc ReadConsoleW GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree SetStdHandle HeapSize WriteConsoleW SetEndOfFile SetFilePointerEx GetFileAttributesExW GetEnvironmentVariableA CreateFileW DeleteFileW GetDiskFreeSpaceExA GetLogicalDrives ReadFile WriteFile GetTempPathW CloseHandle SetHandleInformation GetLastError CreatePipe PeekNamedPipe WaitForSingleObject Sleep GetCurrentProcessId ExitProcess CreateThread GetCurrentThreadId CreateProcessA CreateProcessW GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetModuleFileNameW GetModuleHandleA GetProcAddress GlobalUnlock GlobalLock GetComputerNameA GetConsoleWindow QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW RtlUnwind GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW CopyFileW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStdHandle RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW

Name

.text

Size

349KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rattity.exe

winhttp

crypt32

gdiplus

gdi32

ole32

user32

shell32

advapi32

iphlpapi

kernel32

generic