Overview

overview

10

Static

static

7

69bd0a71b2...a6.exe

windows7-x64

9

69bd0a71b2...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69bd0a71b2a3fcf609ecb92a11a1eb07d2e58f3eb46505309701c5b1655a4ba6

  • Size

    5.6MB

  • Sample

    231019-vygz9aah67

  • MD5

    48b171f32947aa7fe8752fdbf134c667

  • SHA1

    a1ad1fa92b5828965021ad7d0d0a13bba0e51105

  • SHA256

    69bd0a71b2a3fcf609ecb92a11a1eb07d2e58f3eb46505309701c5b1655a4ba6

  • SHA512

    18d6a054953943ef96748ef6e473f77ac203f17cb81cb4456207f6baf65a5461c7c934eee3d47776b70f489dee6963ed5c1d0aeaec75a517ecbd3d7307abaee1

  • SSDEEP

    98304:AjB2VM//vC0Y04Enhst1blRPWcyDxlfnsZm31K3/Mh++FMWzNoNniDH/mviccF:AV2s/vC0AFrRRPWHxl/omlC/eEOoQDHJ

Score
10/10
fatalratevasioninfostealerpersistenceratvmprotect

Malware Config

Targets

    • Target

      69bd0a71b2a3fcf609ecb92a11a1eb07d2e58f3eb46505309701c5b1655a4ba6

    • Size

      5.6MB

    • MD5

      48b171f32947aa7fe8752fdbf134c667

    • SHA1

      a1ad1fa92b5828965021ad7d0d0a13bba0e51105

    • SHA256

      69bd0a71b2a3fcf609ecb92a11a1eb07d2e58f3eb46505309701c5b1655a4ba6

    • SHA512

      18d6a054953943ef96748ef6e473f77ac203f17cb81cb4456207f6baf65a5461c7c934eee3d47776b70f489dee6963ed5c1d0aeaec75a517ecbd3d7307abaee1

    • SSDEEP

      98304:AjB2VM//vC0Y04Enhst1blRPWcyDxlfnsZm31K3/Mh++FMWzNoNniDH/mviccF:AV2s/vC0AFrRRPWHxl/omlC/eEOoQDHJ

    Score
    10/10
    evasionpersistencevmprotectfatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks