Overview

overview

10

Static

static

7

89716752c9...b1.exe

windows7-x64

10

89716752c9...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89716752c9cf49eb40cdecd25ce3771d62cc3a75aad86d1ace3a7f5420d576b1

  • Size

    3.9MB

  • Sample

    230426-eewfjaeg88

  • MD5

    d171792df85fcb02e642f64a10f5c381

  • SHA1

    9ace589fe2d290775a270efaf2d977ca5a79c44f

  • SHA256

    89716752c9cf49eb40cdecd25ce3771d62cc3a75aad86d1ace3a7f5420d576b1

  • SHA512

    b9ea84ddee7a30640758657e30067594ae4e058e0e46eccb840298724e3954efcd489743c9d24cb46226585ae24b888d7afafaaa5f58a2476834b0d1784fbdf3

  • SSDEEP

    49152:X1mvYThzbqn35P1ardVH+o21ClH4W0cNyQMZT5NBtAfjspSgptpDmUzuPUWhLz4S:X1lqnt8dwd1b2WZTFrZjpDmUS9UFQ

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      89716752c9cf49eb40cdecd25ce3771d62cc3a75aad86d1ace3a7f5420d576b1

    • Size

      3.9MB

    • MD5

      d171792df85fcb02e642f64a10f5c381

    • SHA1

      9ace589fe2d290775a270efaf2d977ca5a79c44f

    • SHA256

      89716752c9cf49eb40cdecd25ce3771d62cc3a75aad86d1ace3a7f5420d576b1

    • SHA512

      b9ea84ddee7a30640758657e30067594ae4e058e0e46eccb840298724e3954efcd489743c9d24cb46226585ae24b888d7afafaaa5f58a2476834b0d1784fbdf3

    • SSDEEP

      49152:X1mvYThzbqn35P1ardVH+o21ClH4W0cNyQMZT5NBtAfjspSgptpDmUzuPUWhLz4S:X1lqnt8dwd1b2WZTFrZjpDmUS9UFQ

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks