MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FatalRAT

Vendor detections: 16

Intelligence 16 IOCs 1 YARA 32 File information Comments

SHA256 hash:	f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20
SHA3-384 hash:	40d3cf7abd9d489ea1b23678c31021d0d261bd8beb88ea277353e8fabdd5ad2d96f07e820c2b9b71240c1d21a4aa29e5
SHA1 hash:	b76a3bb42c5ecc17aee5dadd4f1c0221ee0d7019
MD5 hash:	6aeb3e076f1d29cc715f4f48b385c3e1
humanhash:	april-papa-winter-lithium
File name:	6aeb3e076f1d29cc715f4f48b385c3e1.exe
Download:	download sample
Signature	FatalRAT Create hunting rule
File size:	5'169'664 bytes
First seen:	2025-08-03 06:25:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b16cb49bdc6c08e55de67d62235606dc (1 x FatalRAT)
ssdeep	98304:Ryf9Qn6l6YBPO4ClE0genF/QmcnumhJbGVf2S:Ryf9Pp5O4ClEPYFYmcnNhkt2S
TLSH	T1ED367A48B383606BDEBD0FB86E877FEE8222E52C6AD01B96D754CC50D56198FAC37111
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe FatalRAT

abuse_ch

FatalRAT C2:
206.238.196.50:8081

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
206.238.196.50:8081	https://threatfox.abuse.ch/ioc/1563655/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

fatalrat

ID:

File name:

6aeb3e076f1d29cc715f4f48b385c3e1.exe

Verdict:

Malicious activity

Analysis date:

2025-08-03 06:27:31 UTC

Tags:

auto-startup fatalrat rat susp-lnk arch-exec

Link:

https://app.any.run/tasks/718f5035-5578-4036-8c4f-26513b10ca2d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/18535/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=688f010aaf3050dc8d33bcd1

Tags:

autorun emotet madi

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending a custom TCP request

Creating a file

Enabling the 'hidden' option for recently created files

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Creating a process from a recently created file

DNS request

Connection attempt

Searching for synchronization primitives

Searching for the window

Launching the default Windows debugger (dwwin.exe)

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug crypt obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/688f010c73b8ef6f4afbf8e3/reports/c6f0932a-2b21-477e-ac07-94448ccf61a1/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a835ecf4-c110-4327-871f-3e038b03c00e

Result

Threat name:

FatalRAT, GhostRat, Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1749312

Signature

Checks if browser processes are running

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to determine the online IP of the system

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected unpacking (creates a PE file in dynamic memory)

Found stalling execution ending in API Sleep call

Found suspicious ZIP file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Opens the same file many times (likely Sandbox evasion)

Suricata IDS alerts for network traffic

Tries to delay execution (extensive OutputDebugStringW loop)

Yara detected FatalRAT

Yara detected GhostRat

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/6aeb3e076f1d29cc715f4f48b385c3e1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20/

Verdict:

Malicious

Threat:

Trojan.Win32.TCP

Link:

https://tip.neiki.dev/file/f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-07-29 21:35:34 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=64257xd7dirya5hq4ua5r2gyep7tvebaus4ehxngt7z7gskwpuqa._file

Result

Malware family:

fatalrat

Score:

10/10

Tags:

family:fatalrat discovery infostealer rat stealer trojan

Link:

https://tria.ge/reports/250803-g687tahm61/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in System32 directory

Drops startup file

Executes dropped EXE

Loads dropped DLL

Fatal Rat payload

FatalRat

Fatalrat family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b89a0e12-8e54-4421-bb9c-71da04ce13a2

Unpacked files

SH256 hash:

f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20

MD5 hash:

6aeb3e076f1d29cc715f4f48b385c3e1

SHA1 hash:

b76a3bb42c5ecc17aee5dadd4f1c0221ee0d7019

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

3c7fbb564273203df548e9b7c1b45e84034a6c7295bf3f33b84ba22494439faa

MD5 hash:

5a317faf9c6b96e30cb6213e7d9c18b8

SHA1 hash:

032f26d8d86f3894e17f7d83e723b87dc8b1bed7

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

2a0aaa8da20fe5106ecec3fdf69f2109439b683338e048e754059cb569f82c1d

MD5 hash:

3799a281a99404220d9b9b115288f9c9

SHA1 hash:

30a1be4261ebcaefa1fc2008a34baa804ccc6ef7

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

644ebb3c8aa3d2ab7cbb274248979d0ad18bf3396f8de612312b92dad8e94b16

MD5 hash:

8e0cb60e42a625e99b45f462f4382ec0

SHA1 hash:

8e5eb9cc9ce1550c167b542b4f5c823242f60b89

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

c50d191d0e79ae6b60559b1f1b7bf2ea85dbb88d28e5760d35f009d2fd068b21

MD5 hash:

5e79f16f5c9b2d477de00b08a81b8d4a

SHA1 hash:

b10e2df531003fcccfbc2fe0d0fecdc9fad62667

Detections:

win_fatal_rat_w0

win_younglotus_g0

win_fatal_rat_auto

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

Parent samples :

41739bfb9518c5de588152c8090911bf2be7677794d97ff50a7642276752f7c5
8d5f0150d9529fe33d1bae3c8891fa46556782c0d9269215bc8ad672e178a902
252f62fd53af829b188afc11bd2215d0d7793bf3cf0f44c3ac9bb5cb9d5fa2b4
72ea59962c5ac7200d317104a55a6a09d657d3f6c224c963ae380ff39941f04c
9caa90fe0216c66dc29e3049b126643d2a8c68f68663fba2da70a2d9c29d5c49
f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20
9d6d15a37df9799adf1e7fdbd65ab162e770fe0952c91c1ff5c91dc40f1ae659
1caacde9b1b6557c996ffe78f932ffc6ceba05ee3d095e2741df75d3a52c30b2

SH256 hash:

0cef91da68c94ef7a7fcd005c2d30bb874006c2a3b8f6d24ba547d381a9c49f0

MD5 hash:

641223c5692c2e3faf46356e74a2c44e

SHA1 hash:

bb6381432000930d6bf5ec13aced7f79c7a0db94

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

c5ba101135688bd8bf524d8d3abbdf182a1340173273d130e69bf2a24203378d

MD5 hash:

ea91d609e929da8db40e873af0badba5

SHA1 hash:

0b42c1f90363a7c19bb6dc6ed1ec150d440e138f

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

SH256 hash:

28773c3e0a4b782a3a6bcb832f5c6e117d72b2bf8030dbe86d4d6432edf1757b

MD5 hash:

9565d33095cd320ef082187a86d77458

SHA1 hash:

5148f62dfa203e2a3c1c87e5b1a29ba526d2bd1c

Detections:

win_fatal_rat_w0

win_younglotus_g0

win_fatal_rat_auto

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

Link:

https://www.unpac.me/results/f4f92e26-8b1c-447e-8dfd-a48078b8f5b7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f735dfdc7f1a238074f0e501d8e8d823ff3a9020a4b843dda69ff3f349567d20

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Check_DriveSize Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	MALWARE_Win_FatalRAT Create hunting rule
Author:	ditekSHen
Description:	Detects FatalRAT

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	win32_younglotus Create hunting rule
Author:	Reedus0
Description:	Rule for detecting YoungLotus malware

Rule name:	Windows_Generic_Threat_7693d7fd Create hunting rule
Author:	Elastic Security

Rule name:	win_fatal_rat_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.fatal_rat.

Rule name:	win_fatal_rat_w0 Create hunting rule
Author:	AT&T Alien Labs
Description:	Detects FatalRAT, unpacked malware.
Reference:	https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/18535/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high
CHECK_TRUST_INFO	Requires Elevated Execution (uiAccess:None)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CoFreeUnusedLibraries
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetDiskFreeSpaceExA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::DeleteFileA KERNEL32.dll::GetWindowsDirectoryW KERNEL32.dll::GetFileAttributesA KERNEL32.dll::GetTempPathA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuA USER32.dll::CreateMenu USER32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample