SVP7
Static task
static1
Behavioral task
behavioral1
Sample
95eb869c9556716df5db4ec3d58c9ef068b74bb166b6caef26621d2cdd992f37.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
95eb869c9556716df5db4ec3d58c9ef068b74bb166b6caef26621d2cdd992f37.dll
Resource
win10v2004-en-20220113
General
-
Target
95eb869c9556716df5db4ec3d58c9ef068b74bb166b6caef26621d2cdd992f37
-
Size
153KB
-
MD5
f60082d7a771d76c01aa0933296aebc7
-
SHA1
40f6222a47bfcb2be6745a5aa9e5839d51ededbf
-
SHA256
95eb869c9556716df5db4ec3d58c9ef068b74bb166b6caef26621d2cdd992f37
-
SHA512
4a3444e5e0dea2a144d1429670f6ee1ee7226e566ce7a01b05c36d5648edb45dc6f9e1ad54eee6a2f9f55f925cbaf02ecd5862e0fdd1e2f80f1dcfcdca618b19
-
SSDEEP
3072:FSTRXHO5lCOvc4yrDLCNlXOtXazrgtTBf79MxZ6fDgAG:FS93O5lCOMrDuNlXO1aotTBJMxQra
Malware Config
Signatures
-
Fatal Rat Payload 1 IoCs
resource yara_rule sample fatalrat -
Fatalrat family
Files
-
95eb869c9556716df5db4ec3d58c9ef068b74bb166b6caef26621d2cdd992f37.dll windows x86
5fe4841faca6e157669fd55c6a12cbbe
Code Sign
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
Process32Next
Process32First
OutputDebugStringA
Sleep
SetThreadExecutionState
GetLocalTime
CreateDirectoryA
GetLastError
lstrlenA
FreeLibrary
GetTickCount
CloseHandle
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
OpenProcess
WinExec
GetExitCodeThread
SetPriorityClass
GetCurrentProcessId
CreateThread
WriteFile
SetFilePointer
GetFileSize
ExitProcess
CreateProcessA
lstrcatA
RemoveDirectoryA
lstrlenW
WideCharToMultiByte
GetCurrentDirectoryA
MultiByteToWideChar
Beep
CopyFileA
lstrcmpA
ReadFile
GetModuleHandleA
GlobalMemoryStatusEx
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesA
SetFileTime
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetEnvironmentVariableA
FindFirstFileA
DisableThreadLibraryCalls
FindNextFileA
FindClose
DeviceIoControl
InterlockedDecrement
CreateFileA
InterlockedExchange
LocalAlloc
LoadLibraryA
GetProcAddress
LocalReAlloc
LocalSize
LocalFree
lstrcpyA
VirtualFree
user32
GetWindowTextA
GetDesktopWindow
GetLastInputInfo
OpenClipboard
GetClassNameA
ShowWindow
SendMessageA
MoveWindow
GetWindowRect
SwapMouseButton
PostMessageA
FindWindowA
FindWindowExA
GetWindow
wsprintfA
GetSystemMetrics
ChangeDisplaySettingsA
GetKeyState
GetDlgCtrlID
GetAsyncKeyState
GetForegroundWindow
advapi32
EnumServicesStatusA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegDeleteValueA
RegQueryValueA
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shell32
SHChangeNotify
ShellExecuteExA
ole32
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
mfc42
ord668
ord535
ord539
ord5710
ord939
ord540
ord1140
ord926
ord924
ord922
ord858
ord4202
ord537
ord5572
ord800
ord823
ord825
ord356
ord2781
ord4058
ord1980
ord5583
ord3181
ord2770
msvcrt
_onexit
_initterm
_adjust_fdiv
_strcmpi
_strupr
memcpy
ceil
_ftol
__CxxFrameHandler
strcpy
memcmp
_CxxThrowException
strstr
malloc
_except_handler3
_stricmp
_access
_local_unwind2
memset
strcat
strcmp
rand
_mbscmp
strncpy
strrchr
system
memmove
strchr
printf
sprintf
realloc
free
_beginthreadex
fclose
fprintf
fopen
calloc
strlen
_mbsstr
_mbsnbcpy
_mbsicmp
srand
??1type_info@@UAE@XZ
__dllonexit
shlwapi
SHSetValueA
PathStripToRootA
msvcp60
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??1_Winit@std@@QAE@XZ
winmm
mciSendStringA
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
ws2_32
WSACleanup
gethostname
inet_addr
inet_ntoa
gethostbyname
WSAStartup
Exports
Exports
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ