rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 1.8MB
Sample261027-xtytbaec92
SHA256 2f44543851f263c66839ffdca3ad212485cd835849a7fcf2863b532e86d30aa9
MD5 a200c28ed07ea3d831d8e78cfa9aae4b
SHA1 d83f1f4bf98cd7be11dafb01e10364c427e6ef21
SHA512 039844f6d2e0b2180c291d7c308df81088c412cd8c0c8a19dd9a7fb669dd43c639b7616411072d7010b7f03c63b20ff86338641eadfcc280d656c1e8265ea7ef
SSDEEP 24576:GDU4F93Q43BOzgJbT4BwLjashPzAp++cqrMteHz2ulZ8P02jcknCxfsI:IR93QG/hT4qnv+cqrzzng02QkU
TLSH
T13385AE8BA2D101F8C567D179CA07A11BE77278450B216AFF23E06A617F63BE15F7A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 1.8MB

rat.exe

IMPHASH e7a1f51e43ce419ba075992fb67b9eb0
SHA256 2f44543851f263c66839ffdca3ad212485cd835849a7fcf2863b532e86d30aa9
MD5 a200c28ed07ea3d831d8e78cfa9aae4b
SHA1 d83f1f4bf98cd7be11dafb01e10364c427e6ef21
SHA512 039844f6d2e0b2180c291d7c308df81088c412cd8c0c8a19dd9a7fb669dd43c639b7616411072d7010b7f03c63b20ff86338641eadfcc280d656c1e8265ea7ef
SSDEEP 24576:GDU4F93Q43BOzgJbT4BwLjashPzAp++cqrMteHz2ulZ8P02jcknCxfsI:IR93QG/hT4qnv+cqrzzng02QkU
TLSH
T13385AE8BA2D101F8C567D179CA07A11BE77278450B216AFF23E06A617F63BE15F7A301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1144880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\wdyn\Downloads\Popstar-CLEAN\1h32pzt\x64\Release\Savior.pdb

kernel32

GetTickCount GetModuleFileNameW WaitForSingleObject CloseHandle CreateThread CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW OpenProcess GetTickCount64 GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary CreateFileA GetFileSizeEx GetCurrentProcess QueryPerformanceFrequency HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA SetConsoleTitleA InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId IsDebuggerPresent WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceCounter GetCurrentThread Sleep HeapAlloc SetThreadPriority SetPriorityClass VirtualAllocEx ReadProcessMemory ReadFile WriteProcessMemory

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW CreateWindowExW SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW SetCapture RegisterClassExW ShowWindow IsWindow ClientToScreen EnumWindows SetLayeredWindowAttributes FindWindowW SetWindowLongW GetClientRect PostQuitMessage GetWindowTextW GetDC ReleaseDC GetCursorPos SendInput GetWindowThreadProcessId DefWindowProcW mouse_event DispatchMessageW PeekMessageW TranslateMessage EnumDisplaySettingsW GetAsyncKeyState SetWindowPos DestroyWindow IsWindowVisible UnregisterClassW

gdi32

GetDeviceCaps

shell32

ShellExecuteA

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Cnd_signal ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Mtx_lock _Mtx_unlock _Cnd_broadcast ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

winmm

timeBeginPeriod timeEndPeriod

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler wcsstr strstr strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _initterm_e _register_thread_local_exe_atexit_callback _c_exit __p___argv _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type __p___argc _get_initial_narrow_environment _initterm _errno exit _exit

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

fseek setvbuf __stdio_common_vfprintf __acrt_iob_func ftell fputc __p__commode _set_fmode fflush fclose fgetc _fseeki64 fwrite _wfopen fgetpos ungetc __stdio_common_vsscanf fsetpos __stdio_common_vsprintf __stdio_common_vsprintf_s fread _get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

isdigit tolower isspace strncpy_s _stricmp isalnum isxdigit strncpy _wcsicmp strcmp strncmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtof strtoul strtol strtoull

api-ms-win-crt-math-l1-1-0

round _fdclass ceilf acosf powf __setusermatherr cosf sinf nearbyint fmodf floorf sqrtf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale