Overview

overview

10

Static

static

1

Whatsapp.msi

windows7-x64

8

Whatsapp.msi

windows10-1703-x64

10

Whatsapp.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Whatsapp.msi

  • Size

    162.7MB

  • Sample

    230806-gw5fwagb79

  • MD5

    efa5dbed98ee67aaad29dcb32a333ef4

  • SHA1

    cdd185b6c158052fb7d888d0ba2ec0a164843f6f

  • SHA256

    b360f349017399408e0680d71b9c3e774a89ae19259a8396e697fccb18867960

  • SHA512

    9b4fd7bdf60489ad2b6fdd9863a035a7395f6ca462be190083295faff90c365468e3207b5acc1cc95a71f060b8185e53514a8e5c2c7deceec064895814ded0a4

  • SSDEEP

    3145728:VObD8Na5QkjrDpgCbheTWyGYsl2cH5+3StNEkt8KFMOBFilcg5hYiHa8+8Vo6:VcDuaWsPp/tIGYsl2S+3StNAKlsLhZzx

Score
10/10
fatalratinfostealerpersistencerat

Malware Config

Targets

    • Target

      Whatsapp.msi

    • Size

      162.7MB

    • MD5

      efa5dbed98ee67aaad29dcb32a333ef4

    • SHA1

      cdd185b6c158052fb7d888d0ba2ec0a164843f6f

    • SHA256

      b360f349017399408e0680d71b9c3e774a89ae19259a8396e697fccb18867960

    • SHA512

      9b4fd7bdf60489ad2b6fdd9863a035a7395f6ca462be190083295faff90c365468e3207b5acc1cc95a71f060b8185e53514a8e5c2c7deceec064895814ded0a4

    • SSDEEP

      3145728:VObD8Na5QkjrDpgCbheTWyGYsl2cH5+3StNEkt8KFMOBFilcg5hYiHa8+8Vo6:VcDuaWsPp/tIGYsl2S+3StNAKlsLhZzx

    Score
    10/10
    fatalratinfostealerpersistencerat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks