Overview

overview

10

Static

static

7

e06f8c48a8...cb.exe

windows7-x64

10

e06f8c48a8...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e06f8c48a864876ddb10c98fd00ff4a5b3062ad16f7c2c847b367ef8d5e279cb

  • Size

    5.8MB

  • Sample

    231207-f3l3fahdhk

  • MD5

    20c4e0f1811db0244d3ed411aacd73fd

  • SHA1

    45e63fb6a289135a399363ff74ef51731887cf67

  • SHA256

    e06f8c48a864876ddb10c98fd00ff4a5b3062ad16f7c2c847b367ef8d5e279cb

  • SHA512

    ceebdaf1df566ed9d6a88348f44aa1012e9eed42a05378c34a398f8104e2d2b467b8863ee86d37b63f867c0fd4366958aee40efc87337afe8bf517ecc1052583

  • SSDEEP

    98304:NU78vRwBersVSdHbck1lr2as8JQNG0FWJLaIAZhUX+OVRk9c:NsyzdHIKVs8J50FYaIAZhUqc

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      e06f8c48a864876ddb10c98fd00ff4a5b3062ad16f7c2c847b367ef8d5e279cb

    • Size

      5.8MB

    • MD5

      20c4e0f1811db0244d3ed411aacd73fd

    • SHA1

      45e63fb6a289135a399363ff74ef51731887cf67

    • SHA256

      e06f8c48a864876ddb10c98fd00ff4a5b3062ad16f7c2c847b367ef8d5e279cb

    • SHA512

      ceebdaf1df566ed9d6a88348f44aa1012e9eed42a05378c34a398f8104e2d2b467b8863ee86d37b63f867c0fd4366958aee40efc87337afe8bf517ecc1052583

    • SSDEEP

      98304:NU78vRwBersVSdHbck1lr2as8JQNG0FWJLaIAZhUX+OVRk9c:NsyzdHIKVs8J50FYaIAZhUqc

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks