General
-
Target
letsvpn-latest.exe
-
Size
17.8MB
-
Sample
240720-lkxn4szdqc
-
MD5
982df76237c9ff52ad1d2cda5176fbc3
-
SHA1
fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35
-
SHA256
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419
-
SHA512
7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2
-
SSDEEP
393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI
Behavioral task
behavioral1
Sample
letsvpn-latest.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
letsvpn-latest.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
letsvpn-latest.exe
-
Size
17.8MB
-
MD5
982df76237c9ff52ad1d2cda5176fbc3
-
SHA1
fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35
-
SHA256
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419
-
SHA512
7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2
-
SSDEEP
393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-