Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    192KB

  • Sample

    240312-zhm9jsae81

  • MD5

    35c9b6da794925ee797ce0f6aff3b65b

  • SHA1

    8b2b5d61fc207ffc1483af64da93b61ea6f822f3

  • SHA256

    032fa2a25fe3191577ef3e046b524d1af6d7a94619603309a36d8746f02a8238

  • SHA512

    bcc4576d8f61a02711823e0cc66d9e008006335a28ead8b39cbe5459cf37c88b14c5aa086467c7a3cbb0c8f9f34197fcc30996dda3fc4a030949bc72599c1ecf

  • SSDEEP

    3072:T1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f:NSzkPDNGEf

Score
10/10
fatalratinfostealerrat

Malware Config

Targets

    • Target

      tmp

    • Size

      192KB

    • MD5

      35c9b6da794925ee797ce0f6aff3b65b

    • SHA1

      8b2b5d61fc207ffc1483af64da93b61ea6f822f3

    • SHA256

      032fa2a25fe3191577ef3e046b524d1af6d7a94619603309a36d8746f02a8238

    • SHA512

      bcc4576d8f61a02711823e0cc66d9e008006335a28ead8b39cbe5459cf37c88b14c5aa086467c7a3cbb0c8f9f34197fcc30996dda3fc4a030949bc72599c1ecf

    • SSDEEP

      3072:T1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f:NSzkPDNGEf

    Score
    10/10
    fatalratinfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks