Overview

overview

10

Static

static

7

4f46c5da50...fe.exe

windows7-x64

10

4f46c5da50...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f46c5da50a2ceb8c78f0fc2739439d5c544fe6d0924d6f61ecd7c2453565efe

  • Size

    15.4MB

  • Sample

    230906-zzlr2sbh7y

  • MD5

    e70b3364e3116ab6b74b3469f92b7d4b

  • SHA1

    ad5500681da9b21288e75e2d5fffeca8b4209145

  • SHA256

    4f46c5da50a2ceb8c78f0fc2739439d5c544fe6d0924d6f61ecd7c2453565efe

  • SHA512

    d1db8b03568e1b5a0318c4744a070740d62f8849b756c81a8ed33d5511e57a40f76dfb3ab9065a681fe659fcf9406ea6e012eb03003ce5dc5e9cbc0f82469c96

  • SSDEEP

    393216:K8Z5ubaquU3Ie1no4aHLup8f7A2yefA4KaxEUtN:K8ZIbMU3Z1J7ODR1fzKaXtN

Score
10/10
fatalrataspackv2evasioninfostealerpersistenceratupx

Malware Config

Targets

    • Target

      4f46c5da50a2ceb8c78f0fc2739439d5c544fe6d0924d6f61ecd7c2453565efe

    • Size

      15.4MB

    • MD5

      e70b3364e3116ab6b74b3469f92b7d4b

    • SHA1

      ad5500681da9b21288e75e2d5fffeca8b4209145

    • SHA256

      4f46c5da50a2ceb8c78f0fc2739439d5c544fe6d0924d6f61ecd7c2453565efe

    • SHA512

      d1db8b03568e1b5a0318c4744a070740d62f8849b756c81a8ed33d5511e57a40f76dfb3ab9065a681fe659fcf9406ea6e012eb03003ce5dc5e9cbc0f82469c96

    • SSDEEP

      393216:K8Z5ubaquU3Ie1no4aHLup8f7A2yefA4KaxEUtN:K8ZIbMU3Z1J7ODR1fzKaXtN

    Score
    10/10
    fatalrataspackv2evasioninfostealerpersistenceratupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks