General

  • Target

    Firefox-Setup.msi

  • Size

    6.1MB

  • Sample

    221228-gjhrcahe93

  • MD5

    d739d27f7b5f589efbd674b36a550f96

  • SHA1

    97408f933772312614f82cbaeedd8fcd1a136f04

  • SHA256

    31f15864c8e234405ce72067c73557dac90c8f38a0b396966210f807385590ab

  • SHA512

    0bd748085318b70280e50ee4db091ae24a301fc701a16f5963d7dbda8121eaa1cfba1fa0d3f6ac77873d7d668a8cd5601bd5cbc1aa250b6827440e273a59b516

  • SSDEEP

    98304:10Zn7K+AOFnWnnuxTBzZOqUDtOjYgvM2BgwmSSjnduYRFhEvBA6D4BAX1fPQ:1WxLVNZONm0fwXVY1Evic4BAX1fPQ

Malware Config

Targets

    • Target

      Firefox-Setup.msi

    • Size

      6.1MB

    • MD5

      d739d27f7b5f589efbd674b36a550f96

    • SHA1

      97408f933772312614f82cbaeedd8fcd1a136f04

    • SHA256

      31f15864c8e234405ce72067c73557dac90c8f38a0b396966210f807385590ab

    • SHA512

      0bd748085318b70280e50ee4db091ae24a301fc701a16f5963d7dbda8121eaa1cfba1fa0d3f6ac77873d7d668a8cd5601bd5cbc1aa250b6827440e273a59b516

    • SSDEEP

      98304:10Zn7K+AOFnWnnuxTBzZOqUDtOjYgvM2BgwmSSjnduYRFhEvBA6D4BAX1fPQ:1WxLVNZONm0fwXVY1Evic4BAX1fPQ

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    • Fatal Rat payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks