Overview

overview

10

Static

static

3

5f0c6b332e...5d.exe

windows7-x64

10

5f0c6b332e...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f0c6b332ecbeeb94f8660d9b5c848908af1e4917a600b22d559352d3d47be5d

  • Size

    8.4MB

  • Sample

    231206-yx1mrahe6v

  • MD5

    aa246caafc8a20e8bc72eadcf20f2b10

  • SHA1

    6ca0bd0ced78d1746be9fb9bd278b9d029e74f08

  • SHA256

    5f0c6b332ecbeeb94f8660d9b5c848908af1e4917a600b22d559352d3d47be5d

  • SHA512

    1582cc4729a543cd54147ed092f348d013e54fcd819fbbfae046d736e3c69cfbdc7e334ebd759b75d15ca90e85b7099297893db59887c66e053900afce09ff42

  • SSDEEP

    98304:xxvIZAUerFooZwXjuPhdTMOgSGF0YMrsWpctwN8IxR88gG/UsQEHxFPZ1:sZrerFooZeIhd1GF0lNBRLcszHxZ

Score
10/10
fatalratgh0stratinfostealerrat

Malware Config

Targets

    • Target

      5f0c6b332ecbeeb94f8660d9b5c848908af1e4917a600b22d559352d3d47be5d

    • Size

      8.4MB

    • MD5

      aa246caafc8a20e8bc72eadcf20f2b10

    • SHA1

      6ca0bd0ced78d1746be9fb9bd278b9d029e74f08

    • SHA256

      5f0c6b332ecbeeb94f8660d9b5c848908af1e4917a600b22d559352d3d47be5d

    • SHA512

      1582cc4729a543cd54147ed092f348d013e54fcd819fbbfae046d736e3c69cfbdc7e334ebd759b75d15ca90e85b7099297893db59887c66e053900afce09ff42

    • SSDEEP

      98304:xxvIZAUerFooZwXjuPhdTMOgSGF0YMrsWpctwN8IxR88gG/UsQEHxFPZ1:sZrerFooZeIhd1GF0lNBRLcszHxZ

    Score
    10/10
    fatalratgh0stratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks