Overview

overview

10

Static

static

3

win32-quickq.exe

windows7-x64

10

win32-quickq.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    win32-quickq.exe.v

  • Size

    97.6MB

  • Sample

    240920-k2v16sydqa

  • MD5

    c9af3d48d25d3df466fe41c40bf1f1c3

  • SHA1

    515d1d06163d8a9466ae9e2c5bfc621b08e00cc4

  • SHA256

    7017d08b045c35306e20675850eb40dcef6c3d5a4b2cbefe30eddb613ba9580e

  • SHA512

    afeba24477cd741622485f67b3c810e23feae3ad3eae0d3f2a9853ef7fc0f65dd94a2febda09265751fc6949503065181b727aeb01bc344980d82d876d43958d

  • SSDEEP

    3145728:NavhTKlk5M0b76BS3W35ddwwbo1174rlM+t6j:N0XXs6WH2wKaO+tW

Score
10/10
fatalratdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      win32-quickq.exe.v

    • Size

      97.6MB

    • MD5

      c9af3d48d25d3df466fe41c40bf1f1c3

    • SHA1

      515d1d06163d8a9466ae9e2c5bfc621b08e00cc4

    • SHA256

      7017d08b045c35306e20675850eb40dcef6c3d5a4b2cbefe30eddb613ba9580e

    • SHA512

      afeba24477cd741622485f67b3c810e23feae3ad3eae0d3f2a9853ef7fc0f65dd94a2febda09265751fc6949503065181b727aeb01bc344980d82d876d43958d

    • SSDEEP

      3145728:NavhTKlk5M0b76BS3W35ddwwbo1174rlM+t6j:N0XXs6WH2wKaO+tW

    Score
    10/10
    fatalratdiscoveryevasioninfostealerpersistencerattrojan

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks