fatalrat | 250307-n6gwwswrsk_pw_infected[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

250307-n6gwwswrsk_pw_infected.zip
Size

57KB
MD5

eddda6523bd3654c1d712802a295d0bb
SHA1

7f461a402c14d37ad8bde070a776accc35b1b26d
SHA256

bea052b739df6a5fa7767f6c547b97751ecc580cdf9f8454add75e0e68bc02fc
SHA512

1caf8c7995c90c58aec920073a27bdb243552fe150336be961761428b02061d64a44403fb789a7a3947be1cbb6551b80c94648eaf33b35a2a3275f51d8aa4e5e
SSDEEP

1536:rIIKOfAKmKCHzriUnACUGHMh4BbFqMb6EdOwXR1/JkIDHVX0hCV/aoRWDtMwG5jt:rIgfX+ri0HMaBbFq2h9P/GIDR0hCRaoh

Score

10^/10

rat infostealer fatalrat

Malware Config

Extracted

Family

fatalrat

103.171.167.50

Signatures

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
static1/unpack001/312dcfade140789f9f5ec30d66bfcb3614b4ec697c005b53db571c8bc8d90b91	fatalrat

Fatalrat family
fatalrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/312dcfade140789f9f5ec30d66bfcb3614b4ec697c005b53db571c8bc8d90b91

Files

250307-n6gwwswrsk_pw_infected.zip
.zip

Password: infected
312dcfade140789f9f5ec30d66bfcb3614b4ec697c005b53db571c8bc8d90b91
.dll windows:4 windows x86 arch:x86

15ff780ad959cc7132e95a50ed9bfe0e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
Process32Next
Process32First
OutputDebugStringA
Sleep
SetThreadExecutionState
GetLocalTime
CreateDirectoryA
GetLastError
lstrlenA
FreeLibrary
GetTickCount
CloseHandle
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
OpenProcess
WinExec
GetExitCodeThread
SetPriorityClass
ExitProcess
CreateThread
WriteFile
SetFilePointer
GetFileSize
lstrcpyA
CreateProcessA
lstrcatA
RemoveDirectoryA
Beep
CopyFileA
lstrcmpA
ReadFile
GetModuleHandleA
GlobalMemoryStatusEx
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
GetEnvironmentVariableA
FindFirstFileA
MultiByteToWideChar
DisableThreadLibraryCalls
FindNextFileA
FindClose
DeviceIoControl
InterlockedDecrement
CreateFileA
InterlockedExchange
LocalAlloc
LoadLibraryA
GetProcAddress
LocalReAlloc
LocalSize
LocalFree
GetCurrentProcessId
VirtualFree

user32

MessageBoxA
GetLastInputInfo
GetWindow
GetClassNameA
ShowWindow
SendMessageA
MoveWindow
GetWindowRect
SwapMouseButton
PostMessageA
FindWindowA
FindWindowExA
GetDlgCtrlID
OpenClipboard
wsprintfA
GetSystemMetrics
GetWindowTextA
GetForegroundWindow
GetKeyState
GetAsyncKeyState
ChangeDisplaySettingsA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegDeleteValueA
RegQueryValueA
GetUserNameA
RegSetValueExA
RegCreateKeyExA
EnumServicesStatusA

shell32

ShellExecuteExA
SHChangeNotify

ole32

CoInitializeEx
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

mfc42

ord800
ord823
ord537
ord4202
ord924
ord926
ord1140
ord540
ord668
ord1980
ord5583
ord3181
ord4058
ord2781
ord2770
ord356
ord5572
ord825

msvcrt

fclose
fprintf
fopen
??1type_info@@UAE@XZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strupr
_strcmpi
_beginthreadex
memcpy
ceil
_ftol
__CxxFrameHandler
strcpy
memcmp
_CxxThrowException
strstr
malloc
_except_handler3
_stricmp
_access
_local_unwind2
memset
strcat
strcmp
rand
strncpy
strrchr
_mbscmp
system
memmove
strchr
printf
sprintf
realloc
free

shlwapi

PathStripToRootA
SHSetValueA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

winmm

mciSendStringA

wininet

InternetOpenA
InternetQueryDataAvailable
InternetReadFile
InternetOpenUrlA
InternetCloseHandle

ws2_32

inet_addr
WSAStartup
gethostbyname
inet_ntoa
gethostname
WSACleanup

Exports

Exports

SVP7

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

15ff780ad959cc7132e95a50ed9bfe0e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

shlwapi

msvcp60

winmm

wininet

ws2_32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 16KB - Virtual size: 16KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 16KB - Virtual size: 16KB

.reloc
Size: 8KB - Virtual size: 8KB