Extracted

• • Target

    c9fc7053ad84c62d28263b28e84df8781f322bc17fd050ecfcbad4ba26c2b789

  • Size

    556KB

  • MD5

    6e1acf21c78407c478ec1eb2c38284b8

  • SHA1

    f5f82de57c523a8edcc4f05bb6cae1c3d61f4039

  • SHA256

    c9fc7053ad84c62d28263b28e84df8781f322bc17fd050ecfcbad4ba26c2b789

  • SHA512

    7258cfe7512d199a2a653dfe541de9f26d2e960f72a44a9429f8de6da65d7ed4decf217b4bfa03957abfddf6802c213468c52b809e4934729a0815becb563713

  • SSDEEP

    6144:/ZHQvaAq+hVnEvt/QW23WHtGgMrmCxFrRP+Eple2bhxILkR0FVq7VKuUvtx5bMal:NQvaA3LniXpgxFrDZx+BC+ZbX

  Score

  10^/10

  fatalratgh0stratinfostealerratupx

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Fatal Rat payload

    ratinfostealer

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2