fatalrat | 250307-n6gwwstjax_pw_infected[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

250307-n6gwwstjax_pw_infected.zip
Size

84KB
MD5

fd44ed39f03880c306743d26743ae257
SHA1

05423d551ffaaa2370851478187612a5f80f29fa
SHA256

0ed5a7abe864ac46418a156db537cfcc2d3c7613072e8bf3b59fc48afffae375
SHA512

e79170f9d075de95352a19f560cb693d36e7a23ccc6ce157821b3f28fc3d89bddf054253cc26bc36e0c561d42df3e4fa840b1e61d77899bd8aae515baa4b58cf
SSDEEP

1536:0VxbLLzMvoNb67F/enuKWDjEzAPEvVikSBTOS40ytOLNTGmIuEjxTKf:0PnLQvoNu/enkPEzAMvUk4pSQNaoEjxY

Score

10^/10

rat infostealer fatalrat

Malware Config

Signatures

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
static1/unpack001/013a681ff8c09b5fab6218f4aa493627652c9ec7c6ba88291980b6e00e151201	fatalrat

Fatalrat family
fatalrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/013a681ff8c09b5fab6218f4aa493627652c9ec7c6ba88291980b6e00e151201

Files

250307-n6gwwstjax_pw_infected.zip
.zip

Password: infected
013a681ff8c09b5fab6218f4aa493627652c9ec7c6ba88291980b6e00e151201
.dll windows:4 windows x86 arch:x86

Password: infected

e2a7eb0ebc4ee990a5aaa2d798395f22

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
Process32Next
Process32First
OutputDebugStringA
Sleep
SetThreadExecutionState
GetLocalTime
CreateDirectoryA
GetLastError
lstrlenA
FreeLibrary
GetTickCount
CloseHandle
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
OpenProcess
WinExec
GetExitCodeThread
SetPriorityClass
GetCurrentProcessId
CreateThread
WriteFile
SetFilePointer
GetFileSize
ExitProcess
WideCharToMultiByte
lstrcpyA
CreateProcessA
lstrcatA
RemoveDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
Beep
CopyFileA
lstrcmpA
ReadFile
GetModuleHandleA
GlobalMemoryStatusEx
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesA
SetFileTime
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetEnvironmentVariableA
FindFirstFileA
DisableThreadLibraryCalls
FindNextFileA
FindClose
DeviceIoControl
InterlockedDecrement
CreateFileA
InterlockedExchange
LocalAlloc
LoadLibraryA
GetProcAddress
LocalReAlloc
LocalSize
LocalFree
lstrlenW
VirtualFree

user32

GetWindowTextA
GetDesktopWindow
GetLastInputInfo
OpenClipboard
GetClassNameA
ShowWindow
SendMessageA
MoveWindow
GetWindowRect
SwapMouseButton
PostMessageA
FindWindowA
FindWindowExA
GetWindow
wsprintfA
GetSystemMetrics
ChangeDisplaySettingsA
GetKeyState
GetDlgCtrlID
GetAsyncKeyState
GetForegroundWindow

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegDeleteValueA
RegQueryValueA
GetUserNameA
RegSetValueExA
RegCreateKeyExA
EnumServicesStatusA

shell32

SHChangeNotify
ShellExecuteExA

ole32

CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize

oleaut32

SysAllocString
VariantClear
SysFreeString

mfc42

ord535
ord539
ord5710
ord800
ord939
ord2770
ord356
ord5572
ord537
ord4202
ord924
ord926
ord1140
ord540
ord1980
ord5583
ord3181
ord4058
ord2781
ord668
ord823
ord825

msvcrt

_initterm
_adjust_fdiv
_strcmpi
_strupr
_onexit
memcpy
ceil
_ftol
__CxxFrameHandler
strcpy
memcmp
_CxxThrowException
strstr
malloc
_except_handler3
_stricmp
_access
_local_unwind2
memset
strcat
strcmp
_mbscmp
rand
strncpy
strrchr
system
memmove
strchr
printf
sprintf
realloc
free
_beginthreadex
fclose
fprintf
fopen
calloc
strlen
_mbsstr
_mbsnbcpy
_mbsicmp
srand
??1type_info@@UAE@XZ
__dllonexit

shlwapi

SHSetValueA
PathStripToRootA

msvcp60

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

winmm

mciSendStringA

wininet

InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

ws2_32

WSACleanup
gethostname
inet_addr
inet_ntoa
gethostbyname
WSAStartup

Exports

Exports

SVP7

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e2a7eb0ebc4ee990a5aaa2d798395f22

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

shlwapi

msvcp60

winmm

wininet

ws2_32

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 100KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 14KB - Virtual size: 17KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 101KB - Virtual size: 100KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 14KB - Virtual size: 17KB

.reloc
Size: 7KB - Virtual size: 6KB