Overview

overview

10

Static

static

7

d95d7da7bc...6a.exe

windows7-x64

d95d7da7bc...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a

  • Size

    7.8MB

  • Sample

    231215-fmskaacag8

  • MD5

    0ff89a747039fda2b552d6dd405b3dca

  • SHA1

    c0abfbfe54e09e312be89111d8f5b770c038be8e

  • SHA256

    d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a

  • SHA512

    c9e5f35d6637a4bcf600a414d556f6221f24991c23378d24a811ed85806ac797058c49e805e2600523f90dab2e4607b4551334cf93210a01e93a29ce3b5c3424

  • SSDEEP

    196608:RfYOSYUX/C+TFsIsESAxj0dUv1RJsASY8Wb2PVpu9Q3AJ:RrU6+ZsNU0YsE8b/

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a

    • Size

      7.8MB

    • MD5

      0ff89a747039fda2b552d6dd405b3dca

    • SHA1

      c0abfbfe54e09e312be89111d8f5b770c038be8e

    • SHA256

      d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a

    • SHA512

      c9e5f35d6637a4bcf600a414d556f6221f24991c23378d24a811ed85806ac797058c49e805e2600523f90dab2e4607b4551334cf93210a01e93a29ce3b5c3424

    • SSDEEP

      196608:RfYOSYUX/C+TFsIsESAxj0dUv1RJsASY8Wb2PVpu9Q3AJ:RrU6+ZsNU0YsE8b/

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks