Overview

overview

10

Static

static

3

Avc.exe

windows7-x64

10

Avc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Avc.exe

  • Size

    7.8MB

  • Sample

    240218-tgp4vsbh3t

  • MD5

    9f6000733ad51ff5a95be62811855e5f

  • SHA1

    7ff7d76aa4f0984b65c06f942530efd0160c9a0e

  • SHA256

    34df26560bc85bd15133870be420b25782c037e5fdaba57d7c35080203ed251c

  • SHA512

    32addd254dee4af155fe96d5e918c54f20798d0d23590a861cef0c2db1ac2569230846d8d9473855422b8dc2be2960905cf0198ba9a740b8bf38581ad0873460

  • SSDEEP

    196608:NuBUad84j8rER0TAQGC3Lzec+OFy8fR0Vt22F9Q:NgUK8LTAEDPp+Vt22o

Score
10/10
fatalratinfostealerratupx

Malware Config

Targets

    • Target

      Avc.exe

    • Size

      7.8MB

    • MD5

      9f6000733ad51ff5a95be62811855e5f

    • SHA1

      7ff7d76aa4f0984b65c06f942530efd0160c9a0e

    • SHA256

      34df26560bc85bd15133870be420b25782c037e5fdaba57d7c35080203ed251c

    • SHA512

      32addd254dee4af155fe96d5e918c54f20798d0d23590a861cef0c2db1ac2569230846d8d9473855422b8dc2be2960905cf0198ba9a740b8bf38581ad0873460

    • SSDEEP

      196608:NuBUad84j8rER0TAQGC3Lzec+OFy8fR0Vt22F9Q:NgUK8LTAEDPp+Vt22o

    Score
    10/10
    fatalratinfostealerratupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks