fatalrat

General

Target

c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c
Size

4.1MB
Sample

240912-kxpnlazflh
MD5

cb70bb3597ba353f6ba350d77213d4c1
SHA1

38e83fa2f9749ffc25a7315afa876abb94377487
SHA256

c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c
SHA512

efefe46ff2e33d7e5b6a4f9fb608b78fc9adb2c756e1f3313de5a7896e4c9d2e85e06f56d1c791f435b346c2970dbddc0a2d9968d20eb0041ff42f76643872df
SSDEEP

98304:rMmHt1xZ37UW8JQ7Ay3yaThVK3cIbM5eWu6lWA/pZ1GF:ZHt1xZoW5Ay33hzaM5q1A/di

Score

10^/10

Malware Config

Targets

- Target
  
  名单助手I.exe
- Size
  
  6.1MB
- MD5
  
  74f27f7c16f1df18dabb2e7cdaa1a972
- SHA1
  
  d333a571677f1472d5fd26ffa43ad2f96dde18fd
- SHA256
  
  fc1f2107672a4af330678c2dd2ca7a2701e8d79123c339292a72f0d31ce296a0
- SHA512
  
  b07c3e66674b6809d6773a8d1387dcca6859698ecd4a0c37aac0bc6103fa25efa0d6ea6dd342c68201b21dcc54ae80c9c1fc2a9aeee70022d690570fb287b12b
- SSDEEP
  
  98304:LYYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjb:kiby94pFKjBGr97eL
Score

10^/10

fatalrat defense_evasion discovery infostealer rat gh0strat upx
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  infostealer rat fatalrat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Fatal Rat payload
  rat infostealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  说明.pdf
- Size
  
  124KB
- MD5
  
  aa7d7c618d66d6cb4dc58c0844f91960
- SHA1
  
  3b82d40797afa9c57345c2fb6e52094676e06f22
- SHA256
  
  2e299fc0fed1497cce5551abc1894fd188a231fa87550c43f57475a6add4b866
- SHA512
  
  307675c9fe04901fafb662805374c8138468eaef48683b553ce5bd7e9f57bc18890e62509f880955e7f6a912cbec927fe2787d163b6c466bd5e4ac49409fa6c8
- SSDEEP
  
  3072:rsnN7QT3y55hTsTmFuIUYJqF2/3VlfcdZVey0FQZywLfN/2p2T0VDU:rs63S5hk4uIUYJq4f/cUy0Fasp2TM4
Score

3^/10

discovery
behavioral3 behavioral4