MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FatalRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
SHA3-384 hash: a2f5169237b50cca53690c21b62aa14859de5b23dffd2f9141d7804e49db348cb9a1810aca8536e6f65a2e70bc8c8771
SHA1 hash: a0af9b5d07f9706c7c6b0400d72678d9ebd76817
MD5 hash: e73f31c9d92c587c238158df4efed2b8
humanhash: carolina-edward-wisconsin-freddie
File name:E73F31C9D92C587C238158DF4EFED2B8.exe
Download: download sample
Signature FatalRAT
Create hunting rule
File size:4'588'032 bytes
First seen:2025-08-12 05:35:30 UTC
Last seen:2025-08-12 14:45:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5976c6fac496b94620428b1203dbfec8 (1 x FatalRAT)
ssdeep 98304:grDFkFxDX1g6YNpRxVF8uxG1Q31bXfYfl/f3EnaDHWlNlz:gHFwxDFKV+GG141bXf2WMHUt
TLSH T1B126331C0422D4A3FA541B7F8908FA903469ACB6A7C2657C2ED0FF9976B1EF8D857D01
TrID 39.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
24.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 7cdcf8f938fcfce0 (1 x FatalRAT)
Reporter abuse_ch
Tags:exe FatalRAT


Avatar
abuse_ch
FatalRAT C2:
154.82.76.10:8081

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
154.82.76.10:8081 https://threatfox.abuse.ch/ioc/1567590/

Intelligence

File Origin
# of uploads :
2
# of downloads :
46
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
fatalrat
Create hunting rule
ID:
1
File name:
E73F31C9D92C587C238158DF4EFED2B8.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 05:35:54 UTC
Tags:
upx auto-startup fatalrat rat arch-exec delphi
Link:
https://app.any.run/tasks/b6d28cbd-9099-49c6-9de0-3f2f1e2b8f15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
FatalRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20276/
Detection(s):
PUA.Win.Packer.UpxProtector-1
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689ad2b1fca70bd90e8eaa37
Tags:
shellcode autorun virus spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
DNS request
Connection attempt
Searching for synchronization primitives
Searching for the window
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/31b46ac9-1b93-43f2-8443-23fb097fa0a3
Result
Threat name:
FatalRAT, GhostRat, Nitol
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1755044
Signature
Checks if browser processes are running
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to automate explorer (e.g. start an application)
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to determine the online IP of the system
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Creates an undocumented autostart registry key
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Found suspicious ZIP file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Suricata IDS alerts for network traffic
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected FatalRAT
Yara detected GhostRat
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659/
Verdict:
Malicious
Threat:
Trojan.Win32.TCP
Link:
https://tip.neiki.dev/file/9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2025-08-06 20:10:46 UTC
File Type:
PE (Exe)
Extracted files:
53
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvwrli357f4zvxy6p7n5mwvrmltxb7qjkleryh7vzeo4idy24zmq._file
Result
Malware family:
fatalrat
Create hunting rule
Score:
  10/10
Tags:
family:fatalrat discovery infostealer rat stealer trojan upx
Link:
https://tria.ge/reports/250812-gade9sel51/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in System32 directory
UPX packed file
Drops startup file
Executes dropped EXE
Loads dropped DLL
Fatal Rat payload
FatalRat
Fatalrat family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/87309433-f093-4efd-933d-af97d328b5a0
Unpacked files
SH256 hash:
9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
MD5 hash:
e73f31c9d92c587c238158df4efed2b8
SHA1 hash:
a0af9b5d07f9706c7c6b0400d72678d9ebd76817
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
60583a2d3d5c409f99f91d0006b4034731b99eed48fa325bdfe088d3f5b87ed6
MD5 hash:
505157851a5d5227cf4b9e9cf5d63f1a
SHA1 hash:
b140b5d4e56c0097e75c5419ca8f3912445face3
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
305580ff9ce4b54a50b3c85ba1b132592febb4ceea40fe5757b0c27475679339
MD5 hash:
a672e8755f61f80f80d39aebd1121ab6
SHA1 hash:
4be4a392f6aaf4c6ea7010c542d1c3387c249080
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
56299b8ab088f9cca91e8ded231ad631fafd632d6656e906bb9910b33ebead4d
MD5 hash:
fa088de9f713e30d6374b77eae2a8999
SHA1 hash:
2ee08cb0168438864c1b28145b817d900050e4fb
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
da89fd3bc570bc74366f9439410a419eee8d865266c229851e3ff24b93d6dc0b
MD5 hash:
c510e1b7c66d5fb9834c49915eda466e
SHA1 hash:
b0a0761be03e519e10c5e428e1cd48c7f44f9091
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
b1ac2445dfe81d8f63022fd2273cb602f433ae69a68126db9c67f4ad72276374
MD5 hash:
7c2ebb5c2cd93b07cb5b4b13ae35e0c6
SHA1 hash:
e2d4060213fe06c8c294d61d9daf93fc7d56a798
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
c50d191d0e79ae6b60559b1f1b7bf2ea85dbb88d28e5760d35f009d2fd068b21
MD5 hash:
5e79f16f5c9b2d477de00b08a81b8d4a
SHA1 hash:
b10e2df531003fcccfbc2fe0d0fecdc9fad62667
Detections:
win_fatal_rat_w0
Create hunting rule
win_younglotus_g0
Create hunting rule
win_fatal_rat_auto
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
MALWARE_Win_FatalRAT
Create hunting rule
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
Parent samples :
41739bfb9518c5de588152c8090911bf2be7677794d97ff50a7642276752f7c5
8d5f0150d9529fe33d1bae3c8891fa46556782c0d9269215bc8ad672e178a902
252f62fd53af829b188afc11bd2215d0d7793bf3cf0f44c3ac9bb5cb9d5fa2b4
72ea59962c5ac7200d317104a55a6a09d657d3f6c224c963ae380ff39941f04c
9caa90fe0216c66dc29e3049b126643d2a8c68f68663fba2da70a2d9c29d5c49
f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20
9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2
SH256 hash:
b8ddccd61b493fcfc2c42e5434f4482f9ba826de2aa1a6b31de03094f7778d11
MD5 hash:
742f1679a01662317b7c154cddcf7020
SHA1 hash:
103e549bae4a31f2fe02fff47bcb457903749e5f
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
SH256 hash:
c5ba101135688bd8bf524d8d3abbdf182a1340173273d130e69bf2a24203378d
MD5 hash:
ea91d609e929da8db40e873af0badba5
SHA1 hash:
0b42c1f90363a7c19bb6dc6ed1ec150d440e138f
Link:
https://www.unpac.me/results/7ac00a37-e1d1-44aa-97c7-a5d852dbe0f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20276/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (uiAccess:None)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments