Overview

overview

10

Static

static

7

70032d6d08...b4.exe

windows7-x64

10

70032d6d08...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70032d6d08402516ab464181773608750231cf5036a9f1cddfc9aad250ee76b4

  • Size

    15.4MB

  • Sample

    230827-avfmssee57

  • MD5

    72fa8fdb2aeac623d34c8635744670a4

  • SHA1

    1bcb5e0b3f43d0529650225b05e79cf8c59123fc

  • SHA256

    70032d6d08402516ab464181773608750231cf5036a9f1cddfc9aad250ee76b4

  • SHA512

    9398f3a55c978ce993f87595a619f025815fec63e97b15de42ff1acdf8bd770791bdbdfe71ad2ea61fa7af838deb5ef34af4616bf1f15e0829faa82421298b22

  • SSDEEP

    393216:ZZ5ubaquU3Ie1no4aHLup8f7A2yefA4KaxEzJm:ZZIbMU3Z1J7ODR1fzKamJm

Score
10/10
fatalratinfostealerpersistenceratupx

Malware Config

Targets

    • Target

      70032d6d08402516ab464181773608750231cf5036a9f1cddfc9aad250ee76b4

    • Size

      15.4MB

    • MD5

      72fa8fdb2aeac623d34c8635744670a4

    • SHA1

      1bcb5e0b3f43d0529650225b05e79cf8c59123fc

    • SHA256

      70032d6d08402516ab464181773608750231cf5036a9f1cddfc9aad250ee76b4

    • SHA512

      9398f3a55c978ce993f87595a619f025815fec63e97b15de42ff1acdf8bd770791bdbdfe71ad2ea61fa7af838deb5ef34af4616bf1f15e0829faa82421298b22

    • SSDEEP

      393216:ZZ5ubaquU3Ie1no4aHLup8f7A2yefA4KaxEzJm:ZZIbMU3Z1J7ODR1fzKamJm

    Score
    10/10
    fatalratinfostealerpersistenceratupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks