Overview

overview

10

Static

static

3

f74440af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f74440af.exe

  • Size

    116KB

  • Sample

    240117-hfar1aacfj

  • MD5

    f31c2f7530ca8417e023cd63275fc471

  • SHA1

    fc93c75f476e09c23bf8d2d784786e1d3378ff3b

  • SHA256

    f74440af1892f606cf6451e65198161aad3860682c89493212d4bccdc8c79526

  • SHA512

    769ff5d8a755df29cc35b80866a54bc51eaaf825b25e5574feeed1eafa282facb313c75e8662a7e408c8fa85c246904e6b8745205771cdc060cfc089f4850a61

  • SSDEEP

    1536:C9f6Z8WQMVCLpcyHruGZdpgW/auSzeA8bE5+i42V9wf9S:TagVCLWGZdpT/auCeBbErzQ9S

Score
10/10
fatalratinfostealerrat

Malware Config

Targets

    • Target

      f74440af.exe

    • Size

      116KB

    • MD5

      f31c2f7530ca8417e023cd63275fc471

    • SHA1

      fc93c75f476e09c23bf8d2d784786e1d3378ff3b

    • SHA256

      f74440af1892f606cf6451e65198161aad3860682c89493212d4bccdc8c79526

    • SHA512

      769ff5d8a755df29cc35b80866a54bc51eaaf825b25e5574feeed1eafa282facb313c75e8662a7e408c8fa85c246904e6b8745205771cdc060cfc089f4850a61

    • SSDEEP

      1536:C9f6Z8WQMVCLpcyHruGZdpgW/auSzeA8bE5+i42V9wf9S:TagVCLWGZdpT/auCeBbErzQ9S

    Score
    10/10
    fatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks