fatalrat

General

Target

297782811cb69f269c4397e7bb71ce93875d5af3c9477bb0b6b22b11a92b135e
Size

9.8MB
Sample

231207-e28pdaagh3
MD5

0d73e8c3d996fdb9f796472e2270f18e
SHA1

ce891cba235832d3e7a62b899786a215f0c94dff
SHA256

297782811cb69f269c4397e7bb71ce93875d5af3c9477bb0b6b22b11a92b135e
SHA512

592aeea7acbdc214a50e463fc1a424e5c8898b723b8c626216a18bbd24e933e2cd2011d3136ca9307094673f8effb51c8b5a3bf87b397cd9618a30448ae118f6
SSDEEP

196608:9mO/7OgB71cJEfK2DkGztjKWZpoz6QQ+dKFl1x6Ew5ynPnH45u5Hx:9mOjbcJIK2DXhWWpshQ7h6Xy/Y5O

Score

10^/10

Malware Config

Targets

- Target
  
  297782811cb69f269c4397e7bb71ce93875d5af3c9477bb0b6b22b11a92b135e
- Size
  
  9.8MB
- MD5
  
  0d73e8c3d996fdb9f796472e2270f18e
- SHA1
  
  ce891cba235832d3e7a62b899786a215f0c94dff
- SHA256
  
  297782811cb69f269c4397e7bb71ce93875d5af3c9477bb0b6b22b11a92b135e
- SHA512
  
  592aeea7acbdc214a50e463fc1a424e5c8898b723b8c626216a18bbd24e933e2cd2011d3136ca9307094673f8effb51c8b5a3bf87b397cd9618a30448ae118f6
- SSDEEP
  
  196608:9mO/7OgB71cJEfK2DkGztjKWZpoz6QQ+dKFl1x6Ew5ynPnH45u5Hx:9mOjbcJIK2DXhWWpshQ7h6Xy/Y5O
Score

10^/10

fatalrat evasion infostealer rat themida trojan upx
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  infostealer rat fatalrat
- Fatal Rat payload
  rat infostealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Fatal Rat payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

ACProtect 1.3x - 1.4x DLL software

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Themida packer

UPX packed file

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2