General

  • Target

    letsvpn-latest.exe

  • Size

    17.8MB

  • Sample

    240720-lkxn4szdqc

  • MD5

    982df76237c9ff52ad1d2cda5176fbc3

  • SHA1

    fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35

  • SHA256

    8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419

  • SHA512

    7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2

  • SSDEEP

    393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI

Malware Config

Targets

    • Target

      letsvpn-latest.exe

    • Size

      17.8MB

    • MD5

      982df76237c9ff52ad1d2cda5176fbc3

    • SHA1

      fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35

    • SHA256

      8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419

    • SHA512

      7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2

    • SSDEEP

      393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    • Fatal Rat payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks