FadeRAT[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FadeRAT.exe
Size 1.0MB
Sample260922-w4depaxyhz
SHA256 b78014f29668d7355977921e100bf89abe5dad4ba979ccfc6c7ab35de5c11c9e
MD5 8a051ee187a2cdafaf4a757b4aaa8653
SHA1 0b2db62024b88f203bd7b0d63d982866bec85918
SHA512 17bd5077e909fee2e92849f83636c5cb33eba2c6020398776b81b4025f30516219277e47f730a1c95f965b480d0d96d5d727ae6f1fae1f79721f6d27731bc178
SSDEEP 24576:FDIkiA76AQxfdtXdEje+Hn/xIKTcl++7K:FDIc7kzX/+HnZIKTcl
TLSH
T1DB352A57E2A344F8C52FC1B886639772BA70B46946347E2E5E94E7321F20E604F5EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FadeRAT.exe

File Explorer

FadeRAT.exe

.exe 1.0MB

FadeRAT.exe

IMPHASH 80a1740b3ac77e71524fa1aedc000512
SHA256 b78014f29668d7355977921e100bf89abe5dad4ba979ccfc6c7ab35de5c11c9e
MD5 8a051ee187a2cdafaf4a757b4aaa8653
SHA1 0b2db62024b88f203bd7b0d63d982866bec85918
SHA512 17bd5077e909fee2e92849f83636c5cb33eba2c6020398776b81b4025f30516219277e47f730a1c95f965b480d0d96d5d727ae6f1fae1f79721f6d27731bc178
SSDEEP 24576:FDIkiA76AQxfdtXdEje+Hn/xIKTcl++7K:FDIc7kzX/+HnZIKTcl
TLSH
T1DB352A57E2A344F8C52FC1B886639772BA70B46946347E2E5E94E7321F20E604F5EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegSetValueExA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits GetObjectW SelectObject

kernel32

CloseHandle CopyFileA CreatePipe CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection ExitProcess FormatMessageA FreeLibrary GetComputerNameA GetConsoleWindow GetLastError GetModuleFileNameA GetModuleHandleA GetNativeSystemInfo GetProcAddress GetStartupInfoA GetTempPathA GetTickCount GetVersionExA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent LeaveCriticalSection LoadLibraryA LocalFree Process32FirstW Process32NextW RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _get_osfhandle _wfopen fclose fflush fputc fputs fread fwrite getc getwc putc putwc setvbuf ungetc ungetwc fopen _write _read _lseeki64 _ftelli64 _fseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

libwinpthread-1

nanosleep64 pthread_cond_broadcast pthread_cond_wait pthread_create pthread_detach pthread_getspecific pthread_join pthread_key_create pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_num_processors_np pthread_once pthread_setspecific

shell32

SHGetFolderPathA

user32

CallNextHookEx DispatchMessageW GetDC GetKeyboardState GetMessageW GetSystemMetrics MapVirtualKeyW ReleaseDC SetWindowsHookExA ShowWindow ToAscii TranslateMessage UnhookWindowsHookEx

ws2_32

WSAStartup closesocket connect htons inet_pton recv send setsockopt socket

Name

.text

Size

846KB

Virtual Size

846KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FadeRAT.exe

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

libwinpthread-1

shell32

user32

ws2_32

generic