Overview

overview

10

Static

static

3

5726447d80...b9.exe

windows7-x64

10

5726447d80...b9.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5726447d808719aaad889259c482641ae4583e8ac7e16de1688c00425f9935b9

  • Size

    4.6MB

  • Sample

    230926-fb4heaef4w

  • MD5

    bf7e11ba2252db0e6be3c31b137b12dc

  • SHA1

    2ff198c59fe7be2c807816fa243e9c874f85b388

  • SHA256

    5726447d808719aaad889259c482641ae4583e8ac7e16de1688c00425f9935b9

  • SHA512

    aa0493ba6ff5ebd4cfede6fa3fcb29cf00721b44acbd4eb5a65ef11a5e3930ea90aa8726790189f7866bbe4ed67ade81154a37a38063966f663d5d81050fc1ad

  • SSDEEP

    49152:TbEp2+CVgtJO94vM0iTnDJJZk425V/zaBM3SbawwtlY6sKpETPub0J0lTuRjlH6H:TJnVivMba4aBN3SbAYbKpEq0WMRh

Score
10/10
fatalratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      5726447d808719aaad889259c482641ae4583e8ac7e16de1688c00425f9935b9

    • Size

      4.6MB

    • MD5

      bf7e11ba2252db0e6be3c31b137b12dc

    • SHA1

      2ff198c59fe7be2c807816fa243e9c874f85b388

    • SHA256

      5726447d808719aaad889259c482641ae4583e8ac7e16de1688c00425f9935b9

    • SHA512

      aa0493ba6ff5ebd4cfede6fa3fcb29cf00721b44acbd4eb5a65ef11a5e3930ea90aa8726790189f7866bbe4ed67ade81154a37a38063966f663d5d81050fc1ad

    • SSDEEP

      49152:TbEp2+CVgtJO94vM0iTnDJJZk425V/zaBM3SbawwtlY6sKpETPub0J0lTuRjlH6H:TJnVivMba4aBN3SbAYbKpEq0WMRh

    Score
    10/10
    fatalratevasioninfostealerpersistencerat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks