MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FatalRAT

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 25 File information Comments

SHA256 hash:	d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9
SHA3-384 hash:	4201473c720d2513d2228880edf5c13d9eb559b231c7e1eeccf3e3ca584ae670929bd72f34da034a516abcb115ad95bb
SHA1 hash:	f3614d2a1a0e7a8084986250ed4a598ed8c34dc4
MD5 hash:	74197c47ec542c41fd20bca2fc4e1fe2
humanhash:	eight-nuts-maryland-april
File name:	74197C47EC542C41FD20BCA2FC4E1FE2.exe
Download:	download sample
Signature	FatalRAT Create hunting rule
File size:	884'736 bytes
First seen:	2025-07-27 15:25:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3a8897c84eb41f36b4bbabcc617408b8 (6 x FatalRAT, 3 x Nitol)
ssdeep	24576:D0ys/0l0/XvyUe2J1ZF5ufIPvfl90x4c7ZD8OVM:D0yssofekufIHd9Jc9QOVM
TLSH	T10C1512C6DD642236D17B09B0581B24EDF9F54DE21F39E8BA43E183C279712FA9076A43
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe FatalRAT

abuse_ch

FatalRAT C2:
43.248.173.156:8080

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
43.248.173.156:8080	https://threatfox.abuse.ch/ioc/1561179/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

fatalrat

ID:

File name:

_d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9.exe

Verdict:

Malicious activity

Analysis date:

2025-07-27 15:25:59 UTC

Tags:

fatalrat rat

Link:

https://app.any.run/tasks/79782834-6248-43f8-ad41-f0a2a22f7228

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/17163/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=688644ea0b4775fb2132125d

Tags:

vmdetect emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt

Сreating synchronization primitives

Searching for the window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm microsoft_visual_cc obfuscated packed packed safengine_shielden

Link:

https://www.filescan.io/uploads/688644e7a16348d835f03957/reports/78e13839-4c19-4e12-96f0-a6ca8f16e7d6/overview

Verdict:

Malicious

Labled as:

Trojan.PT.Generic

Link:

https://www.hybrid-analysis.com/sample/d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2373cef6-fe46-496d-8e17-19d8771f7615

Result

Threat name:

FatalRAT, GhostRat, Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1744979

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Checks if browser processes are running

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to determine the online IP of the system

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Yara detected FatalRAT

Yara detected GhostRat

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/74197c47ec542c41fd20bca2fc4e1fe2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9/

Verdict:

Malicious

Threat:

Trojan.Win32.Antavmu

Link:

https://tip.neiki.dev/file/d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9

Threat name:

Win32.Downloader.GhostRAT

Status:

Malicious

First seen:

2025-07-24 12:59:00 UTC

AV detection:

19 of 22 (86.36%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=27wdnqczfn3pfq6hrtpotwpnfobdc7mvgojekotpzng3k757ilmq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250727-sttr5sypz9/

Behaviour

System Location Discovery: System Language Discovery

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4edfeaf1-74a1-4d6c-8c13-42e1deb68cba

Unpacked files

SH256 hash:

d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9

MD5 hash:

74197c47ec542c41fd20bca2fc4e1fe2

SHA1 hash:

f3614d2a1a0e7a8084986250ed4a598ed8c34dc4

Link:

https://www.unpac.me/results/ca835ce1-f98a-4376-a235-46cc859d20ed/

SH256 hash:

69cbdb401d6c03f3d64b3bf48d527cb4bf507952f34b170a3d020707fc4ff7be

MD5 hash:

014960b00621ead2d2267bad617a74e9

SHA1 hash:

640534106af63ee5cff7718aee5c459ee5cd609f

Detections:

win_fatal_rat_w0

win_younglotus_g0

win_fatal_rat_auto

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

Link:

https://www.unpac.me/results/ca835ce1-f98a-4376-a235-46cc859d20ed/

Parent samples :

a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca
977c2c64d9fab63868834f7608f1aaf9c5f2b9eed37405964791f94f54589f95
28ad3175fc2c72135a79d95d4fe9cc273f74259800b42635b5c7ddda113a8a44
1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890
fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52
d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9
1bf77a789062dbe0abfc81b3ac0328fc3cfa48f337fa081d35826285996987f4
7a4cd1e7da686434306fa4f3a50b199fc120625bfd41dd39a69768e0fdbe91bb
c5ee5a6276dbfe9ba3b955fca16f049baf43c4438a970295b33a52962bbae98f
243cd136b5aa42c20c048a1fccb215749c482519488f46b05130f5f7dc33583d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	Check_DriveSize Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	MALWARE_Win_FatalRAT Create hunting rule
Author:	ditekSHen
Description:	Detects FatalRAT

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	win32_younglotus Create hunting rule
Author:	Reedus0
Description:	Rule for detecting YoungLotus malware

Rule name:	Windows_Generic_Threat_7693d7fd Create hunting rule
Author:	Elastic Security

Rule name:	win_fatal_rat_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.fatal_rat.

Rule name:	win_fatal_rat_w0 Create hunting rule
Author:	AT&T Alien Labs
Description:	Detects FatalRAT, unpacked malware.
Reference:	https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/17163/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_REG_API	Can Manipulate Windows Registry	KERNEL32.dll::RegDeleteKeyA MSVCRT.dll::RegDeleteKeyA IPHLPAPI.DLL::RegDeleteKeyA PSAPI.DLL::RegDeleteKeyA USER32.dll::RegDeleteKeyA ADVAPI32.dll::RegDeleteKeyA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample