Overview

overview

10

Static

static

1

62733648b4...cb.dll

windows7-x64

10

62733648b4...cb.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62733648b49d1047d165241cd413a7c15ad3231890b7d5034b85bd42b7daf7cb

  • Size

    1.3MB

  • Sample

    240108-hvsaladbdp

  • MD5

    22bead2bf159f53d2b21e46659b1b80c

  • SHA1

    69b150703d948c56d179b18b5d0c0ebe37ec40f4

  • SHA256

    62733648b49d1047d165241cd413a7c15ad3231890b7d5034b85bd42b7daf7cb

  • SHA512

    e8c065138f2527bfd3d6055dc70449d041026957a71baf5a0a4f4111f570bc637d5040012118ae658d85616ac5a0e52206d3795187ac91316814503c9f3c8b79

  • SSDEEP

    24576:ft8lUXMfdZFwH4ucgkrJiu+72qLs9qOet1Wz6f99tHP7F6X8VZH:fqXSY3uu+72Es9VeDW+R+o

Score
10/10
fatalratgh0stratinfostealerrat

Malware Config

Targets

    • Target

      62733648b49d1047d165241cd413a7c15ad3231890b7d5034b85bd42b7daf7cb

    • Size

      1.3MB

    • MD5

      22bead2bf159f53d2b21e46659b1b80c

    • SHA1

      69b150703d948c56d179b18b5d0c0ebe37ec40f4

    • SHA256

      62733648b49d1047d165241cd413a7c15ad3231890b7d5034b85bd42b7daf7cb

    • SHA512

      e8c065138f2527bfd3d6055dc70449d041026957a71baf5a0a4f4111f570bc637d5040012118ae658d85616ac5a0e52206d3795187ac91316814503c9f3c8b79

    • SSDEEP

      24576:ft8lUXMfdZFwH4ucgkrJiu+72qLs9qOet1Wz6f99tHP7F6X8VZH:fqXSY3uu+72Es9VeDW+R+o

    Score
    10/10
    fatalratgh0stratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Fatal Rat payload

      ratinfostealer

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks