Overview

overview

10

Static

static

0e85bfd05d...48.exe

windows7-x64

10

0e85bfd05d...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e85bfd05dd05141b3c2942e6520ad0f07dbe3fc05b2c86d28d748ca76c0c348

  • Size

    37.5MB

  • Sample

    221101-p4v66scad4

  • MD5

    404a26f82379201c853fc1d28c8836c4

  • SHA1

    c41d98806130f0eabb3573454a6397d38ec690d3

  • SHA256

    0e85bfd05dd05141b3c2942e6520ad0f07dbe3fc05b2c86d28d748ca76c0c348

  • SHA512

    104c784d8c83eb2c3c3e8071500fc0201f73b3acab66dc5e650e169674550e616a6b673a56adfbdfe15c5394b8fa1de99d46cc51792844806b2f2241a4038043

  • SSDEEP

    786432:eYZhxUMwYZ6QlkQpbMSFsJQU3AOhp/iX1hvj/1g1I/odi8HnpV:emjCYXlZMSFeACIdiS/odlHT

Score
10/10
fatalratinfostealerrat

Malware Config

Targets

    • Target

      0e85bfd05dd05141b3c2942e6520ad0f07dbe3fc05b2c86d28d748ca76c0c348

    • Size

      37.5MB

    • MD5

      404a26f82379201c853fc1d28c8836c4

    • SHA1

      c41d98806130f0eabb3573454a6397d38ec690d3

    • SHA256

      0e85bfd05dd05141b3c2942e6520ad0f07dbe3fc05b2c86d28d748ca76c0c348

    • SHA512

      104c784d8c83eb2c3c3e8071500fc0201f73b3acab66dc5e650e169674550e616a6b673a56adfbdfe15c5394b8fa1de99d46cc51792844806b2f2241a4038043

    • SSDEEP

      786432:eYZhxUMwYZ6QlkQpbMSFsJQU3AOhp/iX1hvj/1g1I/odi8HnpV:emjCYXlZMSFeACIdiS/odlHT

    Score
    10/10
    fatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks