Behavioral task
behavioral1
Sample
768-54-0x0000000010000000-0x000000001001C000-memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
768-54-0x0000000010000000-0x000000001001C000-memory.dll
Resource
win10v2004-20240226-en
General
-
Target
768-54-0x0000000010000000-0x000000001001C000-memory.dmp
-
Size
112KB
-
MD5
565f360aca19c2a9ff038eb15386ec40
-
SHA1
260a206f9e195ea34861945612dac9717ac25301
-
SHA256
3ca8a049a19043d610d10e3ee5c6e2657dfe3889d3fcc90dfa2fee52bca70ffe
-
SHA512
e69011e5027f201311e552dfee27bee39493cddd7f88acab1d2aebedda749d3ff1b641b8cd9f188239505c8a0795171d8ee5c7be4c8e6e0c7163a94305842e9d
-
SSDEEP
1536:q/53CYUR1wmJkoSA53IXn85c5I9yHT0eRddORHFnToIf2ryZuhPZ6m8gz:qIIC25afeDdYHtTBf2rPZ6m8+
Malware Config
Signatures
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule sample fatalrat -
Fatalrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 768-54-0x0000000010000000-0x000000001001C000-memory.dmp
Files
-
768-54-0x0000000010000000-0x000000001001C000-memory.dmp.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 64KB - Virtual size: 256.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 256.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 256.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 256.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ