Overview

overview

10

Static

static

3

ef784be3a2...4c.exe

windows7-x64

10

ef784be3a2...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c

  • Size

    4.0MB

  • Sample

    231229-m6ntrsdbgm

  • MD5

    c1c1898e903d510a040ba12b7838b2e5

  • SHA1

    91e814f99ace82cad8cc8bde919e7148bd3582a7

  • SHA256

    ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c

  • SHA512

    fa073c10de4f3abc897f4f19bb6c4b6e72a5f0e3a27d6266a158bc8a236a44fe01c2e52a37d3a2b0cf6f78a6bc9e3a1bf69affa476b95e1060a6d3e226fee4c2

  • SSDEEP

    98304:t3/+58f1r2yIrOqFH3aCv6M8mqHS4sjsmRzhIn98E3z9ADmrQ9CZlT:tv+y23Zt8mqRsfRKnWE3uDmwCf

Score
10/10
fatalratinfostealerrat

Malware Config

Targets

    • Target

      ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c

    • Size

      4.0MB

    • MD5

      c1c1898e903d510a040ba12b7838b2e5

    • SHA1

      91e814f99ace82cad8cc8bde919e7148bd3582a7

    • SHA256

      ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c

    • SHA512

      fa073c10de4f3abc897f4f19bb6c4b6e72a5f0e3a27d6266a158bc8a236a44fe01c2e52a37d3a2b0cf6f78a6bc9e3a1bf69affa476b95e1060a6d3e226fee4c2

    • SSDEEP

      98304:t3/+58f1r2yIrOqFH3aCv6M8mqHS4sjsmRzhIn98E3z9ADmrQ9CZlT:tv+y23Zt8mqRsfRKnWE3uDmwCf

    Score
    10/10
    fatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks