Overview

overview

10

Static

static

3

win32-quickq.exe

windows7-x64

10

win32-quickq.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    win32-quickq.exe.v

  • Size

    97.6MB

  • Sample

    240914-k79fraxcja

  • MD5

    28cb97dd589fff168b865529bca31cd9

  • SHA1

    24863be2cf38efd232872111a409ee94a652003e

  • SHA256

    36630eaf2437b09f82ba7b84e11f56227c46c742c8b65d9daddbce9d6ae780e7

  • SHA512

    94af09d0515b7afcf8daaf33e1f946460fce5d0854e0dbf2866529ec949ea4bbb1b5af70bd5030dd1dbe812358a5c3e4952bf7f8dd851893778191523caf38b8

  • SSDEEP

    3145728:HDT6ExPeZmTUhYViYZ/1jedaj23gz7WEbB:icgeVLdjdYoWEN

Score
10/10
fatalratdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      win32-quickq.exe.v

    • Size

      97.6MB

    • MD5

      28cb97dd589fff168b865529bca31cd9

    • SHA1

      24863be2cf38efd232872111a409ee94a652003e

    • SHA256

      36630eaf2437b09f82ba7b84e11f56227c46c742c8b65d9daddbce9d6ae780e7

    • SHA512

      94af09d0515b7afcf8daaf33e1f946460fce5d0854e0dbf2866529ec949ea4bbb1b5af70bd5030dd1dbe812358a5c3e4952bf7f8dd851893778191523caf38b8

    • SSDEEP

      3145728:HDT6ExPeZmTUhYViYZ/1jedaj23gz7WEbB:icgeVLdjdYoWEN

    Score
    10/10
    fatalratdiscoveryevasioninfostealerpersistencerattrojan

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks