SVP7
Behavioral task
behavioral1
Sample
bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d.dll
Resource
win10v2004-20241007-en
General
-
Target
bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d
-
Size
166KB
-
MD5
327f145ea2517d466e859e1cc210139e
-
SHA1
eb9f5781a9f161073611175451d657a2a6223ae0
-
SHA256
bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d
-
SHA512
111611ffff19e746c2a3154cf924a5cd7b530510bce8d5ef1d486523f8b14c4ab6f952ddc6b1786caecf274c4b17a68dea28ecc2e3507ea72cebc8d056f29cdf
-
SSDEEP
3072:Fiq5MoifGhzz8x5PFK/cLV4VvbUN3+OD0LmpttTBfpJwYpnwifr:Fiq5MosGhzzG5PFKe4VvAN3+OwStTBTv
Malware Config
Signatures
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule sample fatalrat -
Fatalrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d
Files
-
bd6569c51bc20ffeb0231dd91786f0a8a4eaa11778f14918de2daf0f5081e00d.dll windows:4 windows x86 arch:x86
334037076a7ceb27eb87bae9805789dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
Process32Next
Process32First
OutputDebugStringA
Sleep
SetThreadExecutionState
GetLocalTime
CreateDirectoryA
GetLastError
lstrlenA
FreeLibrary
GetTickCount
CloseHandle
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
OpenProcess
WinExec
GetExitCodeThread
SetPriorityClass
GetCurrentProcessId
CreateThread
WriteFile
SetFilePointer
GetFileSize
ExitProcess
WideCharToMultiByte
GetModuleHandleA
lstrcatA
lstrcpyA
GlobalMemoryStatusEx
WaitForSingleObject
CreateProcessA
RemoveDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
Beep
CopyFileA
lstrcmpA
ReadFile
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesA
SetFileTime
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetEnvironmentVariableA
FindFirstFileA
DisableThreadLibraryCalls
FindNextFileA
FindClose
DeviceIoControl
InterlockedDecrement
CreateFileA
InterlockedExchange
LocalAlloc
LoadLibraryA
GetProcAddress
LocalReAlloc
LocalSize
LocalFree
lstrlenW
VirtualFree
user32
GetWindowTextA
GetDesktopWindow
ShowWindow
OpenClipboard
MoveWindow
GetWindowRect
SwapMouseButton
PostMessageA
FindWindowExA
GetDlgCtrlID
wsprintfA
GetSystemMetrics
ChangeDisplaySettingsA
SendMessageA
FindWindowA
GetWindow
GetClassNameA
GetKeyState
GetLastInputInfo
GetAsyncKeyState
GetForegroundWindow
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegDeleteValueA
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
EnumServicesStatusA
shell32
SHChangeNotify
ShellExecuteExA
ole32
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize
oleaut32
SysAllocString
VariantClear
SysFreeString
mfc42
ord535
ord539
ord5710
ord800
ord939
ord2770
ord356
ord5572
ord537
ord4202
ord924
ord926
ord1140
ord540
ord1980
ord5583
ord3181
ord4058
ord2781
ord668
ord823
ord825
msvcrt
_initterm
_adjust_fdiv
_strcmpi
_strupr
_onexit
memcpy
ceil
_ftol
__CxxFrameHandler
strcpy
memcmp
_CxxThrowException
strstr
malloc
_except_handler3
_stricmp
_access
_local_unwind2
memset
strcat
strcmp
_mbscmp
strrchr
strchr
memmove
printf
rand
strncpy
system
sprintf
realloc
free
_beginthreadex
fclose
fprintf
fopen
calloc
strlen
_mbsstr
_mbsnbcpy
_mbsicmp
srand
??1type_info@@UAE@XZ
__dllonexit
shlwapi
SHSetValueA
PathStripToRootA
msvcp60
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
winmm
mciSendStringA
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
ws2_32
WSAStartup
WSACleanup
gethostname
inet_addr
inet_ntoa
gethostbyname
Exports
Exports
Sections
.text Size: 111KB - Virtual size: 256.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 256.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 256.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 256.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ