Overview

overview

10

Static

static

3

a70fe514ac...ca.exe

windows7-x64

10

a70fe514ac...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca.exe

  • Size

    2.6MB

  • Sample

    240628-b2sflswhnj

  • MD5

    6bd5512a96b83249d901a839219d2b0a

  • SHA1

    135782fae43c702daa401e2faaaf963f66e95d46

  • SHA256

    a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca

  • SHA512

    e78746312eb6b307a99566412d5de56e1fa0fa8d3eb760f7268eca36bc491f9dcbe86518d0399ffabd4f237b0461e4191f6c5cb77a2fcc2526b8f5ca901c9b2f

  • SSDEEP

    49152:KnsHyjtk2MYC5GDbZnsHyjtk2MYC5GD+TncLwB/S5jSWIOva6DwmI7qmPV8WXTlh:Knsmtk2aaZnsmtk2apcL

Score
10/10
fatalratinfostealerpersistencerat

Malware Config

Targets

    • Target

      a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca.exe

    • Size

      2.6MB

    • MD5

      6bd5512a96b83249d901a839219d2b0a

    • SHA1

      135782fae43c702daa401e2faaaf963f66e95d46

    • SHA256

      a70fe514acbae5c180dbd53901ac1b9cfeab7d9c20b8c096eeb0fe124d3f28ca

    • SHA512

      e78746312eb6b307a99566412d5de56e1fa0fa8d3eb760f7268eca36bc491f9dcbe86518d0399ffabd4f237b0461e4191f6c5cb77a2fcc2526b8f5ca901c9b2f

    • SSDEEP

      49152:KnsHyjtk2MYC5GDbZnsHyjtk2MYC5GD+TncLwB/S5jSWIOva6DwmI7qmPV8WXTlh:Knsmtk2aaZnsmtk2apcL

    Score
    10/10
    fatalratinfostealerpersistencerat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Detects executables calling ClearMyTracksByProcess

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks