Overview

overview

10

Static

static

1

9c0bc5dceb...44.exe

windows7-x64

10

9c0bc5dceb...44.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c0bc5dceb61efbf72250e8d04003b7b8f7806afba4e6a815b71185d09550144

  • Size

    2.1MB

  • Sample

    231016-hzl95sed64

  • MD5

    d73d71dc32505c87955f992091210f1a

  • SHA1

    88d5e3fb2462b053b1161c8197168f2dafb63317

  • SHA256

    9c0bc5dceb61efbf72250e8d04003b7b8f7806afba4e6a815b71185d09550144

  • SHA512

    231d27c1028c62920d67ae48d76b40e2591490b984cb69d706b1ec118cc6a7e367277f1704a84853bbe16ae9a42e1ce2ecd125f0a5e2019e207bcfe1defbe920

  • SSDEEP

    49152:lbZWaaPLan9GY7Pjp8oNivM0iTnDJJZk425V/zaBM3Sbawwtlx:lH8Lan9hp8oNivMba4aBN3SbAx

Score
10/10
fatalratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      9c0bc5dceb61efbf72250e8d04003b7b8f7806afba4e6a815b71185d09550144

    • Size

      2.1MB

    • MD5

      d73d71dc32505c87955f992091210f1a

    • SHA1

      88d5e3fb2462b053b1161c8197168f2dafb63317

    • SHA256

      9c0bc5dceb61efbf72250e8d04003b7b8f7806afba4e6a815b71185d09550144

    • SHA512

      231d27c1028c62920d67ae48d76b40e2591490b984cb69d706b1ec118cc6a7e367277f1704a84853bbe16ae9a42e1ce2ecd125f0a5e2019e207bcfe1defbe920

    • SSDEEP

      49152:lbZWaaPLan9GY7Pjp8oNivM0iTnDJJZk425V/zaBM3Sbawwtlx:lH8Lan9hp8oNivMba4aBN3SbAx

    Score
    10/10
    fatalratevasioninfostealerpersistencerat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks