Overview

overview

10

Static

static

7

187e065265...66.exe

windows7-x64

10

187e065265...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc2b053ec00c92e9b5644e213b05e7b8ffa71b8cdbd035180e5a1f2afddb7d22

  • Size

    3.8MB

  • Sample

    230426-ehebesgh6x

  • MD5

    b92806b12be9a880b2ab6cd148df4e07

  • SHA1

    477c092f44b10daf6d34299a65f787d5c0557b15

  • SHA256

    dc2b053ec00c92e9b5644e213b05e7b8ffa71b8cdbd035180e5a1f2afddb7d22

  • SHA512

    afc098e28084bc945ec4d846bdda099ea40fe0e335691041eefa2e726637c2b5e9ec12d4f9d4df3cad766023db0fc9928a6e07087631e751e6cd09a6b092e202

  • SSDEEP

    49152:OtZxlnwfrf1EBCfYSIXRfBf/L9NIz0xYrDaZ6bnSDYQIhYPSxfm8wQC9uyFon/Ng:ExnAfC99BJf/jIiYy6Mmx7/N2/xR

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      187e065265bf2cb0fb0b819e8ba1911e68532c449797799d7a325838974fcc66.exe

    • Size

      3.8MB

    • MD5

      54277cdc31558a44bc6b83e607495529

    • SHA1

      897ed86aa916f2f679f5d1d3b5bc3d8ea14b0d5d

    • SHA256

      187e065265bf2cb0fb0b819e8ba1911e68532c449797799d7a325838974fcc66

    • SHA512

      12257f1c3abf77ddb27e31d98a999cb1f3a4cf5fe9957a1d38f19364971c46070a4121583110c615157fef46466c05a67a7872029922afc1c076f5457898e1e0

    • SSDEEP

      98304:6K5A/UQObtXa9UbEc6xnvZLtEt7pcXGIT/+OIavA:m/UQqa9UbOxpEhpXIT/+OIaI

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks