Overview

overview

10

Static

static

7

b970c327c2...a3.exe

windows7-x64

10

b970c327c2...a3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b970c327c2e8914749e73713d4dd743ae3907f0a66bd5c34806c6e5f23cf9aa3

  • Size

    3.8MB

  • Sample

    230426-egq9lafa24

  • MD5

    f43ab10a6a9570e4bdc2fd04aa3aa7c3

  • SHA1

    487c24712a3e6774dbcadebc952d3c53471b84bb

  • SHA256

    b970c327c2e8914749e73713d4dd743ae3907f0a66bd5c34806c6e5f23cf9aa3

  • SHA512

    762704abf2453968779d51f18fd25c28f2b016bfcf9f7ae6d678f9b96706b019214099f5f9dc2497bd5686bbb2e16e4d435137508980cd48a58da8322ec72529

  • SSDEEP

    98304:iYPGZ6Gqx5CyuqoEsgy6SDVpqyEAYOV+pyIXlmgCE660v2Pu0n:iKGqx5Cxq+gNSDzqFacpPM7Jk

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      b970c327c2e8914749e73713d4dd743ae3907f0a66bd5c34806c6e5f23cf9aa3

    • Size

      3.8MB

    • MD5

      f43ab10a6a9570e4bdc2fd04aa3aa7c3

    • SHA1

      487c24712a3e6774dbcadebc952d3c53471b84bb

    • SHA256

      b970c327c2e8914749e73713d4dd743ae3907f0a66bd5c34806c6e5f23cf9aa3

    • SHA512

      762704abf2453968779d51f18fd25c28f2b016bfcf9f7ae6d678f9b96706b019214099f5f9dc2497bd5686bbb2e16e4d435137508980cd48a58da8322ec72529

    • SSDEEP

      98304:iYPGZ6Gqx5CyuqoEsgy6SDVpqyEAYOV+pyIXlmgCE660v2Pu0n:iKGqx5Cxq+gNSDzqFacpPM7Jk

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks