fatalrat | c5ff4725ae010265b75955a4fb342f1d310a12e003b6da7af57246a55329c233 | Triage

Sharing

General

Target

znvxqr.rar
Size

232KB
Sample

240208-bvj6naddhq
MD5

f9b63b4a8775488a0cdf6e420b5a109f
SHA1

36598dbd6ba9dba36f065c8eb4f858a2f67148c9
SHA256

c5ff4725ae010265b75955a4fb342f1d310a12e003b6da7af57246a55329c233
SHA512

cc3ed1403a3f6e8a81ee0cb3b6bb095cd45fcf67af93d5c419e69ff31e6010e35fa7829bf7dd87a1adc13d8f8d81addeff158c5cd78d027f7da98d0e5ae7f567
SSDEEP

6144:RsiIW2R9NWutMbR7FUzgEzq0XPIou4h04ynpJzQb:RsLvWutMbczgEFXgma4yn7Qb

Score

10^/10

fatalrat infostealer persistence rat

Malware Config

Targets

- Target
  
  znvxqr/Agghosts.exe
- Size
  
  23KB
- MD5
  
  5aab297fa8f143bfa67310ad78b76d3f
- SHA1
  
  5db963c2cca1bc8c8c060c52f7df76ccb477f01a
- SHA256
  
  8ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
- SHA512
  
  c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
- SSDEEP
  
  384:08bdzeOuMnujhAz3W1xEuw41M0Jn5DGlIPxh8E9VF0NyEoMe:0wdzeBo4lndw2M8n5DGiPxWE2g
Score

10^/10

fatalrat infostealer persistence rat
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  infostealer rat fatalrat
- Fatal Rat payload
  rat infostealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

fatalratinfostealerpersistencerat

behavioral2

fatalratinfostealerpersistencerat