Managed XDR

home-petik-ss-malware-...poet-rat_sliver_snatch — malware analysis report

File info

Filename
home-petik-ss-malware-2025-04-29_191224a36b6ce8fec4837c1aa3990386_cobalt-strike_poet-rat_sliver_snatch
File type
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
File size
6.2 MB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
22241e395e882a6a84314101748107a7cb148137
SHA256
7b2821df9956976882973fcb1f15470b08a0a0fe467b9a982796c58066c9c8a0
MD5
191224a36b6ce8fec4837c1aa3990386

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
pe_overlay: PE file contains overlay