Overview

overview

10

Static

static

7

d9d3ccf3f3...b6.exe

windows7-x64

10

d9d3ccf3f3...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9d3ccf3f355ec60ad27061d8eb5b9a31b3a69fbfb3fade0079eb28f2feb81b6

  • Size

    11.1MB

  • Sample

    240918-nmj7xayhnj

  • MD5

    ec51bee5512b29362377007f64cd3645

  • SHA1

    5880b8a3056ce2cfbd7018968532c82ddde016b1

  • SHA256

    d9d3ccf3f355ec60ad27061d8eb5b9a31b3a69fbfb3fade0079eb28f2feb81b6

  • SHA512

    699475cd0096128bff8894e7b16706e650a175f6955ed4ed6b7816725d39156184eca04678e7c47e497dd8355a5076dd9054bfb8bb72f95b3054f42d4ab31090

  • SSDEEP

    196608:T99WtyRc7YptEbWnSTLEpyQGl11r7kDXf1zhrAuyPD4y0/1Eg:h9WtyR89bus8yQa1r7mXfthA0ybg

Score
10/10
fatalratdiscoveryinfostealerpersistenceratupxvmprotect

Malware Config

Targets

    • Target

      d9d3ccf3f355ec60ad27061d8eb5b9a31b3a69fbfb3fade0079eb28f2feb81b6

    • Size

      11.1MB

    • MD5

      ec51bee5512b29362377007f64cd3645

    • SHA1

      5880b8a3056ce2cfbd7018968532c82ddde016b1

    • SHA256

      d9d3ccf3f355ec60ad27061d8eb5b9a31b3a69fbfb3fade0079eb28f2feb81b6

    • SHA512

      699475cd0096128bff8894e7b16706e650a175f6955ed4ed6b7816725d39156184eca04678e7c47e497dd8355a5076dd9054bfb8bb72f95b3054f42d4ab31090

    • SSDEEP

      196608:T99WtyRc7YptEbWnSTLEpyQGl11r7kDXf1zhrAuyPD4y0/1Eg:h9WtyR89bus8yQa1r7mXfthA0ybg

    Score
    10/10
    fatalratdiscoveryinfostealerpersistenceratupxvmprotect

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks