Overview

overview

10

Static

static

3

ef1b05a2a6...bc.exe

windows7-x64

10

ef1b05a2a6...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc

  • Size

    884KB

  • Sample

    240308-vpm5xacf26

  • MD5

    07050f58d4734f94d71d5c656306c23b

  • SHA1

    0e7fb849a476226e5f00ae52ee14bc7a04934e8a

  • SHA256

    ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc

  • SHA512

    bf56b15e5b40a851241dcaa6005ce6fc1df72355550025a4f18b863258f6f704132c6c6ae1741f58d3944edc71a8d0e9ca44ae29c27d88135202b303f254cb09

  • SSDEEP

    24576:d3HGeQT9vKePfo8j+v3nynH3ounCv6IQF2rmo/hQg:dWtKQfWv34nM82rXZQg

Score
10/10
fatalratinfostealerrat

Malware Config

Targets

    • Target

      ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc

    • Size

      884KB

    • MD5

      07050f58d4734f94d71d5c656306c23b

    • SHA1

      0e7fb849a476226e5f00ae52ee14bc7a04934e8a

    • SHA256

      ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc

    • SHA512

      bf56b15e5b40a851241dcaa6005ce6fc1df72355550025a4f18b863258f6f704132c6c6ae1741f58d3944edc71a8d0e9ca44ae29c27d88135202b303f254cb09

    • SSDEEP

      24576:d3HGeQT9vKePfo8j+v3nynH3ounCv6IQF2rmo/hQg:dWtKQfWv34nM82rXZQg

    Score
    10/10
    fatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks