Overview

overview

10

Static

static

7

707bc3525a...3b.exe

windows7-x64

10

707bc3525a...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    707bc3525aee3985767a7437dea86e1e6f6a658c640867e0c2fa9559f4d9713b

  • Size

    400KB

  • Sample

    240311-gnwtrsdd27

  • MD5

    055922cf1bf7cdeb358243e3b55e7529

  • SHA1

    0f2dbe0f0804e5790d4603d0be29b693e498d91c

  • SHA256

    707bc3525aee3985767a7437dea86e1e6f6a658c640867e0c2fa9559f4d9713b

  • SHA512

    472c9f229bb9ae2b190fb250e261a8a5317ab547e03963604d2db6aee7a94da0f1181fb6a0020fa577b3e7c886e25473837e2e436544c4a97e0785fd856fd52a

  • SSDEEP

    6144:r662RhOKPkaEejVaxQUajLrr1WhgSSvq4bHSVQg8Tyz:rPKqa5paCrb1WhYVSWyz

Score
10/10
fatalratinfostealerratvmprotect

Malware Config

Targets

    • Target

      707bc3525aee3985767a7437dea86e1e6f6a658c640867e0c2fa9559f4d9713b

    • Size

      400KB

    • MD5

      055922cf1bf7cdeb358243e3b55e7529

    • SHA1

      0f2dbe0f0804e5790d4603d0be29b693e498d91c

    • SHA256

      707bc3525aee3985767a7437dea86e1e6f6a658c640867e0c2fa9559f4d9713b

    • SHA512

      472c9f229bb9ae2b190fb250e261a8a5317ab547e03963604d2db6aee7a94da0f1181fb6a0020fa577b3e7c886e25473837e2e436544c4a97e0785fd856fd52a

    • SSDEEP

      6144:r662RhOKPkaEejVaxQUajLrr1WhgSSvq4bHSVQg8Tyz:rPKqa5paCrb1WhYVSWyz

    Score
    10/10
    fatalratinfostealerratvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks