Extracted

• • Target

    60bc990b3a74ed7ee10a303e5319e4fc01d2e788fda90b490d31c007de549f12

  • Size

    445KB

  • MD5

    2eaa973156357628d59acfc550f9f550

  • SHA1

    191afca726c49a5666f2a29ab44b9c3d5c8c6246

  • SHA256

    60bc990b3a74ed7ee10a303e5319e4fc01d2e788fda90b490d31c007de549f12

  • SHA512

    2565e8618e22b93f56ff4b7ac70d5a8517a4ddf606f93cc2b41031aee96756a662d905189f2782d7eaabd60638ff515d82d2cfb3e4802a3c45cd5648d3e2de82

  • SSDEEP

    1536:qKQ+11vu5ywVmbUM9lU4MHZLYT3cyav6eIePL2NJQV6kY4+85qBRmSIDzZsqmUbO:qKlX1jbxX+8czIWL2nk6kY9BRJGTtmt

  Score

  10^/10

  fatalratgh0stratinfostealerratupx

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Fatal Rat payload

    ratinfostealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2