fudrat | 9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582

Sharing

Copy URL Twitter E-mail

General

Target
9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582
Size 736KB
Sample260807-hvmecahn2z
SHA256 9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582
MD5 e091b9971da3995607e3dd2307d37985
SHA1 cf710384b4a2f830b863c54a9dcc4978317e4c83
SHA512 1d220b4f2daaa4028584ef23af68bc4dd0696de09edb7605031ff3535981988b94d36188f8e32add30b92317b341b101b5b193560099f104bd3851f650556e45
SSDEEP 12288:zngxcuvqhO8fW/GPTpmbYa9+hMpsVsovFiRBySu:6cuSBA+Wps+o9wzu
TLSH
T1F4F45C1B57A902FCE0BBE17899065A42E775781A03B19FDF03D00A672E976E09F3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat fudrat

Malware Config

Signatures

Family: FudRAT
FudRAT is a Windows RAT written in C++.
rat fudrat

Detects FudRAT 1 IoCs

resource	yara_rule
sample	family_fudrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582

File Explorer

9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582

.exe 736KB

9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582

IMPHASH 9f7df7c049f9afb806ac2d206164bfe4
SHA256 9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582
MD5 e091b9971da3995607e3dd2307d37985
SHA1 cf710384b4a2f830b863c54a9dcc4978317e4c83
SHA512 1d220b4f2daaa4028584ef23af68bc4dd0696de09edb7605031ff3535981988b94d36188f8e32add30b92317b341b101b5b193560099f104bd3851f650556e45
SSDEEP 12288:zngxcuvqhO8fW/GPTpmbYa9+hMpsVsovFiRBySu:6cuSBA+Wps+o9wzu
TLSH
T1F4F45C1B57A902FCE0BBE17899065A42E775781A03B19FDF03D00A672E976E09F3E750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects FudRAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

515824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipSaveImageToStream

mf

MFEnumDeviceSources

ole32

CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CreateStreamOnHGlobal CLSIDFromString CoTaskMemFree

oleaut32

VariantClear SysAllocStringLen SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen

shell32

SHFileOperationW SHGetFolderPathW ShellExecuteW ShellExecuteA

advapi32

CheckTokenMembership RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteTreeW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority FreeSid GetTokenInformation GetUserNameW RegQueryValueExW RegDeleteValueW

user32

OpenInputDesktop GetMonitorInfoW ExitWindowsEx mouse_event keybd_event CallNextHookEx GetSystemMetrics ReleaseDC DispatchMessageW PeekMessageW MapVirtualKeyA MessageBoxA UnhookWindowsHookEx TranslateMessage ClipCursor SetWindowsHookExW SetThreadDesktop SetProcessDPIAware ToUnicode GetForegroundWindow VkKeyScanA AttachThreadInput GetAsyncKeyState GetKeyboardState EnumDisplayMonitors GetDC MapVirtualKeyW GetWindowThreadProcessId EnumDisplayDevicesW SendMessageW

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection SelectObject BitBlt

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW EnumSystemLocalesW HeapReAlloc SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead CreateEventW ResetEvent GetConsoleMode HeapSize WriteConsoleW VirtualQuery LoadLibraryExA CreateMutexW SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx GetCurrentProcessId ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile FindClose CreateFileW DeleteFileW CloseHandle MoveFileExW ExitProcess Sleep CreateDirectoryW SetHandleInformation ExpandEnvironmentStringsW CreatePipe GetEnvironmentVariableW WaitForSingleObject GetFileAttributesW SetFileAttributesW GetLastError GetFileAttributesExW CreateProcessW CopyFileW CreateProcessA MoveFileW GetExitCodeProcess GetCurrentProcess TerminateProcess ExpandEnvironmentStringsA OpenProcess CreateToolhelp32Snapshot Process32NextW CreateFileA Process32FirstW GetProcAddress GetModuleHandleW LocalFree VirtualProtect VirtualAlloc GetModuleFileNameW LoadLibraryA FlushInstructionCache IsDebuggerPresent GetTempPathW GetSystemDirectoryW MultiByteToWideChar GetComputerNameW WideCharToMultiByte GetCommandLineW GetCurrentThreadId LoadLibraryW FreeLibrary GetTickCount64 GetSystemInfo GlobalMemoryStatusEx WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime

Name

.text

Size

706KB

Virtual Size

706KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9aa17be0bbb8cd4d7c7bb945b01a83d3d12e4b0007fc33383b595abef7adf582

gdiplus

mf

ole32

oleaut32

shell32

advapi32

user32

gdi32

mfplat

mfreadwrite

kernel32

generic