MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FatalRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
SHA3-384 hash: ace5eb8afd8f2f6587b970e56a70ff2622d4e0b886168e990acd61d85f9d7b88b0a9c439cd698c0016622a8254fc6c3b
SHA1 hash: 551efc45cbecb6c1cab76d746141547073a7c7e1
MD5 hash: a9c0c623c9ea4a53b9d36e77e8159391
humanhash: romeo-mango-spring-diet
File name:a9c0c623c9ea4a53b9d36e77e8159391.exe
Download: download sample
Signature FatalRAT
Create hunting rule
File size:8'246'784 bytes
First seen:2025-08-15 00:20:16 UTC
Last seen:2025-09-17 07:16:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 37ff436608dfd4229b923028faaf734a (2 x FatalRAT)
ssdeep 196608:2neNyg/D+j+IQBoVVpJu2fwNBNV34RhmxEbnjdb1/loPYo:TRb6Q4Q24NHV4Nbxb1/loPYo
TLSH T13B861AD9BE938DD2FE4900BD8F4BD967E62EBA53403958F2710A66F0D01035393EE619
TrID 45.6% (.EXE) InstallShield setup (43053/19/16)
17.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
11.1% (.EXE) Win64 Executable (generic) (10522/11/4)
6.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon cc92e4dcecf0f0f0 (1 x FatalRAT)
Reporter abuse_ch
Tags:exe FatalRAT longlq-cl


Avatar
abuse_ch
FatalRAT C2:
156.247.40.47:8081

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
156.247.40.47:8081 https://threatfox.abuse.ch/ioc/1568696/

Intelligence

File Origin
# of uploads :
2
# of downloads :
52
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
fatalrat
Create hunting rule
ID:
1
File name:
_1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2.exe
Verdict:
Malicious activity
Analysis date:
2025-08-15 00:21:11 UTC
Tags:
auto-startup susp-lnk arch-exec fatalrat rat
Link:
https://app.any.run/tasks/8e5c3255-4c6e-4888-bfb1-3312980ee76e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21467/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689e7d6648c64d68735c6fcd
Tags:
autorun emotet madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Searching for synchronization primitives
Searching for the window
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypt packed
Link:
https://www.filescan.io/uploads/689e7d639ef4d2ff7cfe0dd3/reports/fab69c8f-e6f1-4dcd-848a-fc330e6b0769/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29a9c82c-c7c2-475a-9917-0dde50925b6d
Result
Threat name:
FatalRAT, GhostRat, Nitol
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1757566
Signature
Checks if browser processes are running
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to automate explorer (e.g. start an application)
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to determine the online IP of the system
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Creates an undocumented autostart registry key
Detected unpacking (creates a PE file in dynamic memory)
Found stalling execution ending in API Sleep call
Found suspicious ZIP file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Suricata IDS alerts for network traffic
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected FatalRAT
Yara detected GhostRat
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/a9c0c623c9ea4a53b9d36e77e8159391
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2/
Verdict:
Malicious
Threat:
Trojan.Win32.TCP
Link:
https://tip.neiki.dev/file/1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2025-08-08 19:28:40 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dsvm32nrwzkxzglp7z4psmx7y3hlubpohuev4j2b3525hjjmgcza._file
Result
Malware family:
fatalrat
Create hunting rule
Score:
  10/10
Tags:
family:fatalrat discovery infostealer rat stealer trojan
Link:
https://tria.ge/reports/250815-am6h9abq8v/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in System32 directory
Drops startup file
Executes dropped EXE
Loads dropped DLL
Fatal Rat payload
FatalRat
Fatalrat family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8ff7bbd4-d4f9-4d60-bf07-e79f36c9e584
Unpacked files
SH256 hash:
1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
MD5 hash:
a9c0c623c9ea4a53b9d36e77e8159391
SHA1 hash:
551efc45cbecb6c1cab76d746141547073a7c7e1
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
0ddcfa247c71e506be25f64ba7f846a91b6bec9a2aac63839f151eeb1a0d5cce
MD5 hash:
abf40226cd3c2ab82cf24b5cd5d34af2
SHA1 hash:
0ca5c0ebc3f125c57f83e6e256abdb087b82cd65
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
2a0aaa8da20fe5106ecec3fdf69f2109439b683338e048e754059cb569f82c1d
MD5 hash:
3799a281a99404220d9b9b115288f9c9
SHA1 hash:
30a1be4261ebcaefa1fc2008a34baa804ccc6ef7
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
7505aeb80bcf0700d015cac74abebeb807396be592d197a776f4b2761c86a0ef
MD5 hash:
015e33c593a248448b552ac7cd2e18a1
SHA1 hash:
a0553da8898afcbcff18e7d143eebac076194a39
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
ee71bd48a4655b14217a0b2ac1441ebd6d5a7eb3310e453bd76acb57414d62f1
MD5 hash:
00d3f451c795790fddd6d4be8b0cc776
SHA1 hash:
b437ba643df9b9e48a1f5507cad0360b3e5ab1bd
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
c50d191d0e79ae6b60559b1f1b7bf2ea85dbb88d28e5760d35f009d2fd068b21
MD5 hash:
5e79f16f5c9b2d477de00b08a81b8d4a
SHA1 hash:
b10e2df531003fcccfbc2fe0d0fecdc9fad62667
Detections:
win_fatal_rat_w0
Create hunting rule
win_younglotus_g0
Create hunting rule
win_fatal_rat_auto
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
MALWARE_Win_FatalRAT
Create hunting rule
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
Parent samples :
41739bfb9518c5de588152c8090911bf2be7677794d97ff50a7642276752f7c5
8d5f0150d9529fe33d1bae3c8891fa46556782c0d9269215bc8ad672e178a902
252f62fd53af829b188afc11bd2215d0d7793bf3cf0f44c3ac9bb5cb9d5fa2b4
72ea59962c5ac7200d317104a55a6a09d657d3f6c224c963ae380ff39941f04c
9caa90fe0216c66dc29e3049b126643d2a8c68f68663fba2da70a2d9c29d5c49
f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20
9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
SH256 hash:
4781d15edb5b451cae1b8a2a6224bdde73ca1836c11da5a27b6fb3262e24f7c8
MD5 hash:
5eacb6703911248c266d92e89fe1f0c9
SHA1 hash:
a7201d3b3750c7593167ca3600a02f0da973e1b3
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
c5ba101135688bd8bf524d8d3abbdf182a1340173273d130e69bf2a24203378d
MD5 hash:
ea91d609e929da8db40e873af0badba5
SHA1 hash:
0b42c1f90363a7c19bb6dc6ed1ec150d440e138f
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
SH256 hash:
4ecd28df5ea05853fe154f7baef578b69b97ff06a13953d194a84cb78b7e900e
MD5 hash:
c1e4322d6d5ddd208d80e17c8ac5dcb8
SHA1 hash:
cd24d1b0b042d7b6786c3b5a28a9834d15b750a4
Link:
https://www.unpac.me/results/2edcfc18-5f92-4ef6-bde4-0984d28da09a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21467/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (uiAccess:None)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CoFreeUnusedLibraries
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetDiskFreeSpaceExA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::DeleteFileA
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetFileAttributesA
KERNEL32.dll::GetTempPathA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::CreateMenu
USER32.dll::CreateWindowExA

Comments