Overview

overview

10

Static

static

7

win32-quickq.exe

windows7-x64

10

win32-quickq.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    win32-quickq.exe.vir

  • Size

    96.1MB

  • Sample

    240807-s9vdlstenf

  • MD5

    86070741782fef50023aedd4d9ae7749

  • SHA1

    803654c7a33fa34fadec369c2cb56220f6e97699

  • SHA256

    7ff792e6fbf711a1230e8d5d49eac55d26567796435655af08eceebf27093368

  • SHA512

    4e06f424636fb4d345e7917974c72aaec3561df18af81d17ce248a12670991cb014838efb05d5ac8369561f9a957b297cc6679be8dd0b4f952186d42da656b55

  • SSDEEP

    3145728:gwgwEHtKqYKDPoAmL1EcgpDYPSvinKZzH:lnawAmpg64BZz

Score
10/10
fatalrataspackv2discoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Targets

    • Target

      win32-quickq.exe.vir

    • Size

      96.1MB

    • MD5

      86070741782fef50023aedd4d9ae7749

    • SHA1

      803654c7a33fa34fadec369c2cb56220f6e97699

    • SHA256

      7ff792e6fbf711a1230e8d5d49eac55d26567796435655af08eceebf27093368

    • SHA512

      4e06f424636fb4d345e7917974c72aaec3561df18af81d17ce248a12670991cb014838efb05d5ac8369561f9a957b297cc6679be8dd0b4f952186d42da656b55

    • SSDEEP

      3145728:gwgwEHtKqYKDPoAmL1EcgpDYPSvinKZzH:lnawAmpg64BZz

    Score
    10/10
    fatalrataspackv2discoveryevasioninfostealerpersistencerattrojanupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks