Overview

overview

10

Static

static

3

afd07970c1...db.exe

windows7-x64

10

afd07970c1...db.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afd07970c1ec3cb7e7ee33a6cd158a92a8cfd0e1279f9fa962ab067d990e53db

  • Size

    192KB

  • Sample

    240603-cv3tfahc43

  • MD5

    43152df794e12063ee12a31d789c04c6

  • SHA1

    b5f9b8ba9c032fa2c1ee680d75823498843a5f41

  • SHA256

    afd07970c1ec3cb7e7ee33a6cd158a92a8cfd0e1279f9fa962ab067d990e53db

  • SHA512

    3aeb5895d2c62a4a9d0d09da6146726aa7b6b7db071e7fb8a9fab22d56c1a0f9248f36f2c387aac79dfaa0156a02d10c006733f66d7e1d4134654f39be897134

  • SSDEEP

    3072:91ltw5LZseWDzoPZ6WS6BLfvgaSlpcD+08f:+SzkPDNGVf

Score
10/10
fatalratinfostealerpersistencerat

Malware Config

Targets

    • Target

      afd07970c1ec3cb7e7ee33a6cd158a92a8cfd0e1279f9fa962ab067d990e53db

    • Size

      192KB

    • MD5

      43152df794e12063ee12a31d789c04c6

    • SHA1

      b5f9b8ba9c032fa2c1ee680d75823498843a5f41

    • SHA256

      afd07970c1ec3cb7e7ee33a6cd158a92a8cfd0e1279f9fa962ab067d990e53db

    • SHA512

      3aeb5895d2c62a4a9d0d09da6146726aa7b6b7db071e7fb8a9fab22d56c1a0f9248f36f2c387aac79dfaa0156a02d10c006733f66d7e1d4134654f39be897134

    • SSDEEP

      3072:91ltw5LZseWDzoPZ6WS6BLfvgaSlpcD+08f:+SzkPDNGVf

    Score
    10/10
    fatalratinfostealerpersistencerat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Detects executables calling ClearMyTracksByProcess

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks