MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FatalRAT

Vendor detections: 19

Intelligence 19 IOCs 1 YARA 18 File information Comments

SHA256 hash:	1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890
SHA3-384 hash:	efa72168e3374242b0569e48813bc970636de823c0639e67974bec6e41eca97271aa5f5b44da7494265de278cd29e1ad
SHA1 hash:	5be0eda7871d21a35bf39963a712c725cf4495f5
MD5 hash:	5009c9f812e1dc51616d958d2f950957
humanhash:	louisiana-cold-winner-florida
File name:	5009c9f812e1dc51616d958d2f950957.exe
Download:	download sample
Signature	FatalRAT Create hunting rule
File size:	196'608 bytes
First seen:	2025-07-14 21:00:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6c306e45fa9f977a2f45c8a08df084d5 (2 x YoungLotus, 2 x FatalRAT)
ssdeep	3072:T1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f:NSzkPDNGEf
Threatray	56 similar samples on MalwareBazaar
TLSH	T12414AE4628964779DCCD02B1E13D9A6C119E49E0AA31F8EE572E686B47313D7F1E3307
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe FatalRAT

abuse_ch

FatalRAT C2:
156.245.198.81:8081

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
156.245.198.81:8081	https://threatfox.abuse.ch/ioc/1556760/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

fatalrat

ID:

File name:

5009c9f812e1dc51616d958d2f950957.exe

Verdict:

Malicious activity

Analysis date:

2025-07-14 21:01:06 UTC

Tags:

fatalrat rat

Link:

https://app.any.run/tasks/201a517f-a993-4482-b715-7bcc1ac1ddb1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

FatalRAT

Link:

https://www.capesandbox.com/analysis/14320/

Detection(s):

Win.Trojan.Killmbr-10022827-0

Win.Trojan.Killmbr-10022828-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68756ff8900df8e7f86ab975

Tags:

farfli emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Launching a service

Searching for the window

Searching for synchronization primitives

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a process with a hidden window

Moving of the original file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autorun farfli microsoft_visual_cc

Link:

https://www.filescan.io/uploads/68756ffc12460d69545d705b/reports/996fe44d-e6bb-4b28-a5ee-88570a4127ab/overview

Verdict:

Malicious

Labled as:

Dump:Generic.KillMBR.A

Link:

https://www.hybrid-analysis.com/sample/1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

Malware family:

Gh0st RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/efccb679-8829-4d74-b93b-0fc733e6ad5e

Result

Threat name:

FatalRAT, GhostRat, Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1736518

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Checks if browser processes are running

Contains functionality of a second stage malware downloader

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to determine the online IP of the system

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Found stalling execution ending in API Sleep call

Malicious sample detected (through community Yara rule)

Moves itself to temp directory

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Tries to delay execution (extensive OutputDebugStringW loop)

Yara detected FatalRAT

Yara detected GhostRat

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/5009c9f812e1dc51616d958d2f950957

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890/

Verdict:

Malicious

Threat:

Win32.Backdoor.Zegost

Link:

https://tip.neiki.dev/file/1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

Threat name:

Win32.Backdoor.Zegost

Status:

Malicious

First seen:

2025-07-12 18:29:05 UTC

File Type:

PE (Exe)

AV detection:

32 of 38 (84.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dpmmoqbbyjfzdqj2atpukmdgdk77ve5p3trhlrew4xnz74cvjcia._file

Verdict:

malicious

Label(s):

fatalrat

FatalRAT

1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

FatalRAT

28ad3175fc2c72135a79d95d4fe9cc273f74259800b42635b5c7ddda113a8a44

FatalRAT

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419

FatalRAT

a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794

FatalRAT

a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca

FatalRAT

error

FatalRAT

+ 46 additional samples on MalwareBazaar

Result

Malware family:

fatalrat

Score:

10/10

Tags:

family:fatalrat discovery infostealer rat stealer trojan

Link:

https://tria.ge/reports/250714-ztlj4aam7v/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

Fatal Rat payload

FatalRat

Fatalrat family

Verdict:

Malicious

Tags:

Win.Trojan.Killmbr-10022827-0

YARA:

n/a

Link:

https://app.threat.zone/submission/1847860f-3580-448b-b354-d904cc9be8ea

Unpacked files

SH256 hash:

1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

MD5 hash:

5009c9f812e1dc51616d958d2f950957

SHA1 hash:

5be0eda7871d21a35bf39963a712c725cf4495f5

Link:

https://www.unpac.me/results/de60c551-3765-48e6-877a-2e5fffa59edb/

SH256 hash:

69cbdb401d6c03f3d64b3bf48d527cb4bf507952f34b170a3d020707fc4ff7be

MD5 hash:

014960b00621ead2d2267bad617a74e9

SHA1 hash:

640534106af63ee5cff7718aee5c459ee5cd609f

Detections:

win_fatal_rat_w0

win_younglotus_g0

win_fatal_rat_auto

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

Link:

https://www.unpac.me/results/de60c551-3765-48e6-877a-2e5fffa59edb/

Parent samples :

a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca
977c2c64d9fab63868834f7608f1aaf9c5f2b9eed37405964791f94f54589f95
28ad3175fc2c72135a79d95d4fe9cc273f74259800b42635b5c7ddda113a8a44
1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890
fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52
d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9
1bf77a789062dbe0abfc81b3ac0328fc3cfa48f337fa081d35826285996987f4
7a4cd1e7da686434306fa4f3a50b199fc120625bfd41dd39a69768e0fdbe91bb
c5ee5a6276dbfe9ba3b955fca16f049baf43c4438a970295b33a52962bbae98f
243cd136b5aa42c20c048a1fccb215749c482519488f46b05130f5f7dc33583d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.94

Link:

https://yomi.yoroi.company/submissions/1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	Check_DriveSize Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	MALWARE_Win_FatalRAT Create hunting rule
Author:	ditekSHen
Description:	Detects FatalRAT

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	win32_younglotus Create hunting rule
Author:	Reedus0
Description:	Rule for detecting YoungLotus malware

Rule name:	Windows_Generic_Threat_7693d7fd Create hunting rule
Author:	Elastic Security

Rule name:	win_fatal_rat_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.fatal_rat.

Rule name:	win_fatal_rat_w0 Create hunting rule
Author:	AT&T Alien Labs
Description:	Detects FatalRAT, unpacked malware.
Reference:	https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/14320/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample