Overview

overview

10

Static

static

7

211e56cfeb...4f.exe

windows7-x64

10

211e56cfeb...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6dc9e261edd148e80897933fb8ba140976c30270df98fb0d4b2f6d2b3d61d8dd

  • Size

    3.8MB

  • Sample

    230426-eepyraeg87

  • MD5

    c214067ce9590d78c5da17f4912bb5da

  • SHA1

    73fee043af6cf37713ed6732c1d20e5901fd3e38

  • SHA256

    6dc9e261edd148e80897933fb8ba140976c30270df98fb0d4b2f6d2b3d61d8dd

  • SHA512

    99f76ad8f50249f3420ab9294f3838089812495d5c0df624898208809231fad275cc8caf71220e7ebf768c2864dd5269df894687c264144b13593c6de40b192a

  • SSDEEP

    98304:9mpZaZ+7yTZdB+HLZsMe3mW8vHByn3ivH:9WMZy+dc1/lynyH

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe

    • Size

      3.8MB

    • MD5

      223a3193b04f2b5564495839f5bfb834

    • SHA1

      b4fe59e6ec8bdf5dbf0d4a34e42cbed269f82082

    • SHA256

      211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f

    • SHA512

      ca94b2ea6971864b399bd73111e4993d25c2675207abc9900c408ff614e63a53398c7e4c778f1043bd63baca2cb077a6fc2783f872263ce8cf3efca11ecd09da

    • SSDEEP

      98304:P+xmA/JbNccZe2TOrilHmUuxnBXzZkHmOB:U13ccZbWPllam

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks