MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FatalRAT

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 24 File information Comments

SHA256 hash:	fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52
SHA3-384 hash:	bfb70d0f04f026af2c218da74be12c577e430cc97317877162e7bcb05c4be80a73b11d03c7c1189e88c1ef70cfd63eae
SHA1 hash:	0e53cc1b5e2d67a4dfb00cf63cc873143af12c3e
MD5 hash:	5e9b98790b1223e754976bdb80ffcf57
humanhash:	oscar-mississippi-purple-robert
File name:	5E9B98790B1223E754976BDB80FFCF57.exe
Download:	download sample
Signature	FatalRAT Create hunting rule
File size:	905'216 bytes
First seen:	2025-07-22 17:15:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3a8897c84eb41f36b4bbabcc617408b8 (6 x FatalRAT, 3 x Nitol)
ssdeep	24576:25WH6q/4W3w53HZm9NgRjrqoE7MvL3DoK2UHmN8DIZqfTfm:4q/4W3w95mcRjWKjHFDIZl
TLSH	T19F1512C9ED381236E0B60470541B64DCE9F90ED11E79D5BA03F143963AB27B5AA3E6C3
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe FatalRAT

abuse_ch

FatalRAT C2:
43.250.173.179:8080

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
43.250.173.179:8080	https://threatfox.abuse.ch/ioc/1559545/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

fatalrat

ID:

File name:

_fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52.exe

Verdict:

Malicious activity

Analysis date:

2025-07-22 17:16:00 UTC

Tags:

fatalrat rat

Link:

https://app.any.run/tasks/c0613627-9599-4c1e-8c7b-6536b175c3fb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/16386/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=687fc73f2f623871a5f1f9ac

Tags:

vmdetect emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Searching for synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt

Сreating synchronization primitives

Searching for the window

Sending a custom TCP request

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm microsoft_visual_cc obfuscated packed packed safengine_shielden

Link:

https://www.filescan.io/uploads/687fc73d8a7d628a81bd18ca/reports/730da503-55f9-4bd6-99a5-8f2bdf027c3f/overview

Verdict:

Malicious

Labled as:

Trojan.PT.Generic

Link:

https://www.hybrid-analysis.com/sample/fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f1b6a58-bc56-43b8-8391-02112bc27c3f

Result

Threat name:

FatalRAT, GhostRat, Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1742210

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Checks if browser processes are running

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to determine the online IP of the system

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Moves itself to temp directory

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Potentially malicious time measurement code found

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Yara detected FatalRAT

Yara detected GhostRat

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/5e9b98790b1223e754976bdb80ffcf57

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52/

Verdict:

Malicious

Threat:

Trojan.Win32.Farfli

Link:

https://tip.neiki.dev/file/fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52

Threat name:

Win32.Backdoor.Farfli

Status:

Malicious

First seen:

2025-07-20 12:34:00 UTC

File Type:

PE (Exe)

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=77ytzjee7gd4iynitlrayvspfe732qz4ciqckxr7ed7dwgwd5nja._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250722-vswapaej6x/

Behaviour

System Location Discovery: System Language Discovery

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ca738fca-8221-47d2-9798-5d474df0717d

Unpacked files

SH256 hash:

fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52

MD5 hash:

5e9b98790b1223e754976bdb80ffcf57

SHA1 hash:

0e53cc1b5e2d67a4dfb00cf63cc873143af12c3e

Link:

https://www.unpac.me/results/cf384da1-2ca4-437c-a02d-53d88c415d81/

SH256 hash:

69cbdb401d6c03f3d64b3bf48d527cb4bf507952f34b170a3d020707fc4ff7be

MD5 hash:

014960b00621ead2d2267bad617a74e9

SHA1 hash:

640534106af63ee5cff7718aee5c459ee5cd609f

Detections:

win_fatal_rat_w0

win_younglotus_g0

win_fatal_rat_auto

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

Link:

https://www.unpac.me/results/cf384da1-2ca4-437c-a02d-53d88c415d81/

Parent samples :

a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca
977c2c64d9fab63868834f7608f1aaf9c5f2b9eed37405964791f94f54589f95
28ad3175fc2c72135a79d95d4fe9cc273f74259800b42635b5c7ddda113a8a44
1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890
fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52
d7ec36c0592b76f2c3c78cdee9d9ed2b82317d953392453a6fcb4db57fbf42d9
1bf77a789062dbe0abfc81b3ac0328fc3cfa48f337fa081d35826285996987f4
7a4cd1e7da686434306fa4f3a50b199fc120625bfd41dd39a69768e0fdbe91bb
c5ee5a6276dbfe9ba3b955fca16f049baf43c4438a970295b33a52962bbae98f
243cd136b5aa42c20c048a1fccb215749c482519488f46b05130f5f7dc33583d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fff13ca484f987c461a89ae20c564f293fbd433c1220255e3f20fe3b1ac3eb52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	Check_DriveSize Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	MALWARE_Win_FatalRAT Create hunting rule
Author:	ditekSHen
Description:	Detects FatalRAT

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	win32_younglotus Create hunting rule
Author:	Reedus0
Description:	Rule for detecting YoungLotus malware

Rule name:	Windows_Generic_Threat_7693d7fd Create hunting rule
Author:	Elastic Security

Rule name:	win_fatal_rat_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.fatal_rat.

Rule name:	win_fatal_rat_w0 Create hunting rule
Author:	AT&T Alien Labs
Description:	Detects FatalRAT, unpacked malware.
Reference:	https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/16386/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_REG_API	Can Manipulate Windows Registry	KERNEL32.dll::RegDeleteKeyA MSVCRT.dll::RegDeleteKeyA IPHLPAPI.DLL::RegDeleteKeyA PSAPI.DLL::RegDeleteKeyA USER32.dll::RegDeleteKeyA ADVAPI32.dll::RegDeleteKeyA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample