Overview

overview

10

Static

static

1

goegloe.exe

windows7-x64

10

goegloe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    goegloe.exe.v

  • Size

    88.2MB

  • Sample

    240907-t66g5stcnr

  • MD5

    cf0aab45779d4352e489c517f307fb32

  • SHA1

    2c3bc637e9d05bfd81544211e15993e0e81fad9a

  • SHA256

    ad79ae909dcc57f10b94dd0554b16267095c63705975cdc0f6a3a0566960fa29

  • SHA512

    666e21bbc20dd0e21443ce37b99da584cc1a9ba71cee1f72a27bfbee035cf188ba8bd417bea6ce727af431b13ee00c70dec95eeafa13ff963b0ae956f51504ce

  • SSDEEP

    1572864:o2Enaw6n4PCjmk0Pl7H7ZFMu0pgVHjMpjIyYlUB4S4UPTlszwwKmuQU:aPnavqB7vMuvBM9Yu6S4URdQU

Score
10/10
fatalratdiscoveryinfostealerpersistenceprivilege_escalationrat

Malware Config

Targets

    • Target

      goegloe.exe.v

    • Size

      88.2MB

    • MD5

      cf0aab45779d4352e489c517f307fb32

    • SHA1

      2c3bc637e9d05bfd81544211e15993e0e81fad9a

    • SHA256

      ad79ae909dcc57f10b94dd0554b16267095c63705975cdc0f6a3a0566960fa29

    • SHA512

      666e21bbc20dd0e21443ce37b99da584cc1a9ba71cee1f72a27bfbee035cf188ba8bd417bea6ce727af431b13ee00c70dec95eeafa13ff963b0ae956f51504ce

    • SSDEEP

      1572864:o2Enaw6n4PCjmk0Pl7H7ZFMu0pgVHjMpjIyYlUB4S4UPTlszwwKmuQU:aPnavqB7vMuvBM9Yu6S4URdQU

    Score
    10/10
    fatalratdiscoveryinfostealerpersistenceprivilege_escalationrat

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks