fatalrat

General

Target

新建文件夹 (2).7z
Size

4.9MB
Sample

230630-jxpg6age93
MD5

5f94ed17f28c2c3f9fa91d953d17dd19
SHA1

34eba3d4d6cfc2c9e4697f455791461f702b69d2
SHA256

75fe871f78a0eea5ce5489c0815c230603aa45e2fc5f7bf67414a90888c63407
SHA512

8b35c485c1c4b51b69e7bfeb8ca54ef0daefe98fe6ee21eb131fa1cadeeda6cf683ba17fe524097d0e5e99966b326927122e590cbe2da4ce38019a13f558a4db
SSDEEP

98304:FSlz52/dwlcmRO2nAa0Qf+mxUQAg7PiY2DPrnZoOanzEQwNG2Nvk+TIf5g+:FOz52F1L2ftOBC7SzCO2zGJNvBsJ

Score

10^/10

Malware Config

Targets

- Target
  
  新建文件夹 (2)/_D0DE469BB8424834A796EDFE1D0176CA.exe
- Size
  
  2.1MB
- MD5
  
  4ac3d60c4850e37a9b39976c1553df05
- SHA1
  
  45e5a0e35be7034e38543fc1a0c3f9ca3808fa5c
- SHA256
  
  c53eac22482ec00bebb3c006d442c7b48a448f9d0cc16a743af9a88de1a1da6c
- SHA512
  
  7b1e7044deab0f485e1968000df3409d003c38728ab6c07026b5818ed3f0550c32afa0149903e6696e306284b2680426ca8e38540292b35f60d3a8827d789753
- SSDEEP
  
  49152:vepDNj9UCdjGNjXn/S1qe7FFsOAckBNMmH3Cy+3u:vKNjuCpaj61RjONQy++
Score

7^/10

upx vmprotect
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  新建文件夹 (2)/f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi
- Size
  
  2.4MB
- MD5
  
  64039f083c96cab5ea0de62f789886ce
- SHA1
  
  ffb89927ad892b7d6e3d6a88ec24a9d6a161dee2
- SHA256
  
  f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f
- SHA512
  
  8eee7c46b8a031858acabe871616e92e95d2e3b4be5b8eae425bc412dc51470c578c6991ba2f3d290a1b96a556853454ea0bb69336e54b9b7aa28354af998fae
- SSDEEP
  
  49152:3BiErnG0fwkAjwzYUrngrwjCBt4CFFDO84D2nng01WQhNzvS65R8ct:XnGvMzYUrhjCBZPO84DH01WQXzvP5xt
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  
  新建文件夹 (2)/新建文件夹/Agghosts.exe
- Size
  
  29KB
- MD5
  
  614ceaa6ab7f39714e24e9e6b7b0c7b4
- SHA1
  
  83b63819fe9a9b8c1624e9969fe125088a873cdc
- SHA256
  
  e46b0297c7cf534ce46bc673062ed903d11b574fb0602c3bb1a30eb4bbf6f05f
- SHA512
  
  406bc2d2602d0b18e41148c211ceeb65580402046b205ae5e2a65421d02e2fb1ffc4fee76fb803b9e3f7b00081375a36b6b9162729ea447a7f10997716529483
- SSDEEP
  
  768:CIl97bHB8CCzEVz1Btnb1WYiRSoQu1xPij97h:xl977KCUUhnbY7RL71x6j9N
Score

10^/10

fatalrat infostealer persistence rat
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  infostealer rat fatalrat
- Fatal Rat payload
  rat infostealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6