Overview

overview

10

Static

static

7

0792f3ace4...3a.exe

windows7-x64

10

0792f3ace4...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a

  • Size

    6.8MB

  • Sample

    240903-l9awmsvend

  • MD5

    e60f2cfa195d7fa2c8fd58e8c0766ceb

  • SHA1

    88c0be4c4289fbca8d7627209e8efc368a5521f5

  • SHA256

    0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a

  • SHA512

    85155700124f35d0a53a383383588d4ac20c512a9caa3895962feb460464d728c408f2931d880dbf84dbfd8b9caf11cf0678163d7fb225dded11e325e717c81e

  • SSDEEP

    196608:/GL5LftH/WBqHVTq8ekeuBODngMCx5Tohf5:eLVtHomDsG8nyTif

Score
10/10
fatalratdiscoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Targets

    • Target

      0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a

    • Size

      6.8MB

    • MD5

      e60f2cfa195d7fa2c8fd58e8c0766ceb

    • SHA1

      88c0be4c4289fbca8d7627209e8efc368a5521f5

    • SHA256

      0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a

    • SHA512

      85155700124f35d0a53a383383588d4ac20c512a9caa3895962feb460464d728c408f2931d880dbf84dbfd8b9caf11cf0678163d7fb225dded11e325e717c81e

    • SSDEEP

      196608:/GL5LftH/WBqHVTq8ekeuBODngMCx5Tohf5:eLVtHomDsG8nyTif

    Score
    10/10
    fatalratdiscoveryevasioninfostealerpersistencerattrojanupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks