🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FatalRAT


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4
SHA3-384 hash: 787dd346e5ea297142b0333ae3e5184d8c90698b7d8913b716bf3c856c0dfe23b7ff88b6318d21c8ca57523b47098788
SHA1 hash: 6f9ea65558ff37bc5a63667828499da18ef87651
MD5 hash: e292109810613816abe14db0da6a6f00
humanhash: april-potato-berlin-fillet
File name:gocgloe.exe
Download: download sample
Signature FatalRAT
Create hunting rule
File size:83'792'840 bytes
First seen:2025-03-21 21:59:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 656a4fe4c8401782dfc51a6e6a892c98 (2 x FatalRAT, 1 x Gh0stRAT, 1 x ValleyRAT)
ssdeep 1572864:heZA96wMSQHS4Q8qIW0QAXNF9/EhqW/gGJ4ChinclW26OzBfuLcRk75:hoVwMSsZqIEAhhW/WQFlW26pL/
Threatray 5 similar samples on MalwareBazaar
TLSH T16508230AA3F941D5E0BBD278CAB69517EA727C569B30D7DF0250024A1F37BE09E39721
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon e8b249cdcd29cae8 (2 x Cosmu, 1 x FatalRAT)
Reporter aachum
Tags:exe FatalRAT


Avatar
iamaachum
https://fangcheng.gfbhgf.cn/llq/?sdclkid=b5-pA5fN15fiArD6AL2&bd_vid=10509239629942497827 => https://lianshenpo.oss-ap-southeast-1.aliyuncs.com/gocgloe.zip

FatalRAT C2: xhlsp.club

Intelligence

File Origin
# of uploads :
1
# of downloads :
475
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
fatalrat
Create hunting rule
ID:
1
File name:
gocgloe.exe
Verdict:
Malicious activity
Analysis date:
2025-03-21 22:07:20 UTC
Tags:
fatalrat rat loader qrcode
Link:
https://app.any.run/tasks/7c485dd4-65ed-4281-bed5-6147b177854d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67dde1fc518d210202e7bd40
Tags:
emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Launching a process
Searching for the window
Creating a file in the Program Files subdirectories
Creating a window
Creating a service
Searching for synchronization primitives
Transferring files using the Background Intelligent Transfer Service (BITS)
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Moving a file to the %temp% directory
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm explorer fingerprint hacktool lolbin microsoft_visual_cc onedrivestandaloneupdater packed packer_detected remote runonce
Link:
https://www.filescan.io/uploads/67dde173e05c48ec61e5cc50/reports/15cb5734-0ef2-4f2c-9a52-67428a14c9b1/overview
Verdict:
Suspicious
Labled as:
Trojan.Win64.Agent
Link:
https://www.hybrid-analysis.com/sample/7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4
Result
Threat name:
FatalRAT, GhostRat, Nitol
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1645580
Signature
Contains functionality to detect virtual machines (IN, VMware)
Creates an undocumented autostart registry key
Detected unpacking (creates a PE file in dynamic memory)
Disables UAC (registry)
Drops executables to the windows directory (C:\Windows) and starts them
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Execution from Suspicious Folder
Suricata IDS alerts for network traffic
Tries to delay execution (extensive OutputDebugStringW loop)
Uses cmd line tools excessively to alter registry or file data
Yara detected FatalRAT
Yara detected GhostRat
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1645580 Sample: gocgloe.exe Startdate: 21/03/2025 Architecture: WINDOWS Score: 100 58 xhlsp.club 2->58 60 xinhelian-1336130708.cos.ap-hongkong.myqcloud.com 2->60 62 4 other IPs or domains 2->62 84 Suricata IDS alerts for network traffic 2->84 86 Malicious sample detected (through community Yara rule) 2->86 88 Multi AV Scanner detection for submitted file 2->88 90 4 other signatures 2->90 8 gocgloe.exe 22 2->8         started        13 Agghosts.exe 2->13         started        signatures3 process4 dnsIp5 66 hk.file.myqcloud.com 43.132.105.214, 443, 49720 LILLY-ASUS Japan 8->66 68 www.wshifen.com 103.235.46.115, 49726, 80 BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd Hong Kong 8->68 70 127.0.0.1 unknown unknown 8->70 36 C:\Users\Public\Downloads\...\bin.exe, PE32 8->36 dropped 38 C:\ProgramData\20250321040120\Agghosts.exe, PE32 8->38 dropped 40 C:\ProgramData\20250321040120\libcef.dll, PE32 8->40 dropped 92 Detected unpacking (creates a PE file in dynamic memory) 8->92 94 Uses cmd line tools excessively to alter registry or file data 8->94 15 bin.exe 73 8->15         started        19 Agghosts.exe 6 8->19         started        22 cmd.exe 1 8->22         started        24 reg.exe 1 1 8->24         started        file6 signatures7 process8 dnsIp9 50 C:\Windows\SystemTemp\...behaviorgraphoogleUpdate.exe, PE32 15->50 dropped 52 C:\Windows\SystemTemp\...\psuser_64.dll, PE32+ 15->52 dropped 54 C:\Windows\SystemTemp\...\psuser.dll, PE32 15->54 dropped 56 65 other files (none is malicious) 15->56 dropped 72 Drops executables to the windows directory (C:\Windows) and starts them 15->72 26 GoogleUpdate.exe 7 72 15->26         started        64 xhlsp.club 137.220.137.21, 49729, 8081 BCPL-SGBGPNETGlobalASNSG Singapore 19->64 74 Detected unpacking (creates a PE file in dynamic memory) 19->74 76 Creates an undocumented autostart registry key 19->76 78 Contains functionality to detect virtual machines (IN, VMware) 19->78 80 Tries to delay execution (extensive OutputDebugStringW loop) 19->80 82 Uses cmd line tools excessively to alter registry or file data 22->82 29 reg.exe 1 22->29         started        32 conhost.exe 22->32         started        34 conhost.exe 1 24->34         started        file10 signatures11 process12 file13 42 C:\Program Files (x86)\...behaviorgraphoogleUpdate.exe, PE32 26->42 dropped 44 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 26->44 dropped 46 C:\Program Files (x86)behaviorgraphoogle\...\psuser.dll, PE32 26->46 dropped 48 65 other files (none is malicious) 26->48 dropped 96 Disables UAC (registry) 29->96 signatures14
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4
Gathering data
Threat name:
Win32.Backdoor.GhostRAT
Create hunting rule
Status:
Malicious
First seen:
2025-03-21 22:00:19 UTC
File Type:
PE+ (Exe)
Extracted files:
3654
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2c6pxibfvo36krcmcfuys3ohcec36gs2pnbxcp7jit5nvlamhka._file
Verdict:
malicious
Label(s):
fatalrat
Create hunting rule
Similar samples:
315dbb0b234d6a550ac6f314b6accb325f3fe4b35b16f045e131188e03d74e39
FatalRAT
c16e6d3d687b1c83f93cfa8de9c9e191fe957c2262c88534cc6f0b66c4cc516c
FatalRAT
error
FatalRAT
f8c117a65e11fd370cb0673d1066af3415dfd9c8fde98225498f6e4ac92c213e
FatalRAT
Result
Malware family:
fatalrat
Create hunting rule
Score:
  10/10
Tags:
family:fatalrat defense_evasion discovery infostealer persistence privilege_escalation rat spyware stealer trojan
Link:
https://tria.ge/reports/250321-1wp6qs1tfz/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Checks system information in the registry
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Boot or Logon Autostart Execution: Active Setup
Event Triggered Execution: Image File Execution Options Injection
Fatal Rat payload
FatalRat
Fatalrat family
UAC bypass
Gathering data
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7685e7dd012d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FatalRAT

Executable exe 7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4

(this sample)

  
Link
https://tria.ge/250321-1qpysavkz9/behavioral1
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll::ConvertStringSidToSidW
ADVAPI32.dll::CopySid
ADVAPI32.dll::CreateWellKnownSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipAlloc
RPC_APICan Execute Remote ProceduresRPCRT4.dll::RpcBindingFree
RPCRT4.dll::RpcBindingFromStringBindingW
RPCRT4.dll::RpcBindingSetAuthInfoExW
RPCRT4.dll::RpcBindingVectorFree
RPCRT4.dll::RpcEpRegisterW
RPCRT4.dll::RpcEpUnregister
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLOpenStreamW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithTokenW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::SetProcessShutdownParameters
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeW
KERNEL32.dll::FindNextVolumeW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateDirectoryA
SHELL32.dll::SHCreateDirectoryExW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupAccountNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptDestroyKey
bcrypt.dll::BCryptEncrypt
bcrypt.dll::BCryptGenerateSymmetricKey
bcrypt.dll::BCryptGenRandom
bcrypt.dll::BCryptOpenAlgorithmProvider
bcrypt.dll::BCryptSetProperty
WIN_CRED_APICan Manipute Windows CredentialsADVAPI32.dll::CredDeleteW
ADVAPI32.dll::CredEnumerateW
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertFindExtension
CRYPT32.dll::CertFreeCertificateChain
CRYPT32.dll::CertGetEnhancedKeyUsage
CRYPT32.dll::CertVerifyCertificateChainPolicy
ADVAPI32.dll::CryptAcquireContextW
CRYPT32.dll::CryptBinaryToStringW
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpCrackUrl
WINHTTP.dll::WinHttpOpen
WINHTTP.dll::WinHttpOpenRequest
WINHTTP.dll::WinHttpQueryDataAvailable
WINHTTP.dll::WinHttpQueryHeaders
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyTransactedW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyExW
ADVAPI32.dll::RegGetValueA
ADVAPI32.dll::RegGetValueW
SHLWAPI.dll::SHRegGetValueW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfig2W
ADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::ControlService
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
WIN_TRUST_APIUses Windows Trust APIWINTRUST.dll::WinVerifyTrustEx
WINTRUST.dll::WTHelperProvDataFromStateData
WIN_USER_APIPerforms GUI ActionsUSER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments