General

  • Target

    aba0ee9b59c0f8114abdd258a9e3a01d9928816b6b3ffd25bd2b9ac62d75f88a

  • Size

    201KB

  • Sample

    230411-kgyassbd74

  • MD5

    438fe1a43c316223c5310a2e71132b1c

  • SHA1

    3ca90032a60c62f8ebf13bf1a6fc15ee5978cbf4

  • SHA256

    aba0ee9b59c0f8114abdd258a9e3a01d9928816b6b3ffd25bd2b9ac62d75f88a

  • SHA512

    d2c88681020f9bfd0fd56b03f66987ffd7c9f05b14b5e41bde055b3e7c1fb03502ada7f525bd706511d9fa638e097f7e85482c64bc5d31d7def92cfe736f6ad5

  • SSDEEP

    6144:MwYEf/HqSnofL4YGwmNx8SoQYNIcGoPsLeVMorTv:BJnoNhD1PhrTv

Malware Config

Extracted

Family

fatalrat

C2

156.236.64.28

Targets

    • Target

      aba0ee9b59c0f8114abdd258a9e3a01d9928816b6b3ffd25bd2b9ac62d75f88a

    • Size

      201KB

    • MD5

      438fe1a43c316223c5310a2e71132b1c

    • SHA1

      3ca90032a60c62f8ebf13bf1a6fc15ee5978cbf4

    • SHA256

      aba0ee9b59c0f8114abdd258a9e3a01d9928816b6b3ffd25bd2b9ac62d75f88a

    • SHA512

      d2c88681020f9bfd0fd56b03f66987ffd7c9f05b14b5e41bde055b3e7c1fb03502ada7f525bd706511d9fa638e097f7e85482c64bc5d31d7def92cfe736f6ad5

    • SSDEEP

      6144:MwYEf/HqSnofL4YGwmNx8SoQYNIcGoPsLeVMorTv:BJnoNhD1PhrTv

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    • Fatal Rat payload

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v6

Tasks