Overview

overview

10

Static

static

3

ae3efb1b41...ad.dll

windows7-x64

10

ae3efb1b41...ad.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae3efb1b411272af7b33672451bd5826202a22670de9d45e924ee4f630694aad

  • Size

    988KB

  • Sample

    240315-q93c4sab7t

  • MD5

    9c1ef756d041773c4bbea023053137b6

  • SHA1

    9aa542b974a7f4efb97032d9b41a3695b5c629c4

  • SHA256

    ae3efb1b411272af7b33672451bd5826202a22670de9d45e924ee4f630694aad

  • SHA512

    09db098308e88450f67a3c9d1d696417b7f02241879d85855d164280ed9a9596dcbe6a96d4f9bf0b473a6fbcb4d37f2681385d59b86a0dca987b8e002b80d277

  • SSDEEP

    24576:yj3A8X9TeaAr64xW/9muOBCXMq8Xu/mjJk5YrbqIVZSySsL:CXct9xcouOsXMHXuMJZrbqIWy

Score
10/10
fatalratevasioninfostealerrat

Malware Config

Targets

    • Target

      ae3efb1b411272af7b33672451bd5826202a22670de9d45e924ee4f630694aad

    • Size

      988KB

    • MD5

      9c1ef756d041773c4bbea023053137b6

    • SHA1

      9aa542b974a7f4efb97032d9b41a3695b5c629c4

    • SHA256

      ae3efb1b411272af7b33672451bd5826202a22670de9d45e924ee4f630694aad

    • SHA512

      09db098308e88450f67a3c9d1d696417b7f02241879d85855d164280ed9a9596dcbe6a96d4f9bf0b473a6fbcb4d37f2681385d59b86a0dca987b8e002b80d277

    • SSDEEP

      24576:yj3A8X9TeaAr64xW/9muOBCXMq8Xu/mjJk5YrbqIVZSySsL:CXct9xcouOsXMHXuMJZrbqIWy

    Score
    10/10
    fatalratevasioninfostealerrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks