rat[.]exe | Triage™

General

Target
rat.exe
Size 677KB
Sample261011-ybdwvsct8x
SHA256 ceceedec44078112d04cddd7e6f6611c0f2fde463ec1fd4e7abfedd336b10da7
MD5 af7b6b59ea650b4dfa4a008e2077d2d2
SHA1 229358027fec734ad86eda3b5601d542454dcd53
SHA512 91f61bb1a163397e551906c66b365f596ff9c21257cbd4d65708f44f05ae88890be19b52378a51099e58949d2543a8fd6faa77aedafc19fc448f75706b0b2928
SSDEEP 12288:aS2WctHpF+2268v0Zs1JcKnoV52Q0f0CElWvd:sWcN8688Zshng52Q0f0CElEd
TLSH
T14BE46C2ABB9015F8D0B3C53ECD06C54AE57A784A133176BB23C0955B6F3B6605B3BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 677KB

rat.exe

IMPHASH 6a58f7b0216395ce6393c8cd0dbec313
SHA256 ceceedec44078112d04cddd7e6f6611c0f2fde463ec1fd4e7abfedd336b10da7
MD5 af7b6b59ea650b4dfa4a008e2077d2d2
SHA1 229358027fec734ad86eda3b5601d542454dcd53
SHA512 91f61bb1a163397e551906c66b365f596ff9c21257cbd4d65708f44f05ae88890be19b52378a51099e58949d2543a8fd6faa77aedafc19fc448f75706b0b2928
SSDEEP 12288:aS2WctHpF+2268v0Zs1JcKnoV52Q0f0CElWvd:sWcN8688Zshng52Q0f0CElEd
TLSH
T14BE46C2ABB9015F8D0B3C53ECD06C54AE57A784A133176BB23C0955B6F3B6605B3BB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

287232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile GetModuleFileNameA GetFileSizeEx Process32First WriteProcessMemory SetHandleInformation FindFirstFileA VirtualProtect GetCurrentProcess WriteFile DeviceIoControl TerminateProcess FindNextFileA CreatePipe ExpandEnvironmentStringsA GetEnvironmentVariableA FindClose CreateMutexA WaitForSingleObject lstrcatA GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 CopyFileA GetLastError GetFileAttributesA CreateFileA QueryPerformanceFrequency DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread GetWindowsDirectoryA Beep VirtualAllocEx LocalFree GetThreadId ExitProcess GetCurrentProcessId GlobalMemoryStatusEx WideCharToMultiByte CreateRemoteThread CreateProcessA GetDiskFreeSpaceExA CreateDirectoryA GetSystemTime VirtualFreeEx QueryPerformanceCounter GetTickCount GetComputerNameA SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA RtlUnwind

user32

DispatchMessageA LoadCursorA SetTimer GetMessageA CreateWindowExA KillTimer PostQuitMessage RegisterClassExA DefWindowProcA

Name

.text

Size

446KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

kernel32

user32

generic