Overview

overview

10

Static

static

3

win32-quickq.exe

windows7-x64

10

win32-quickq.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    win32-quickq.exe.v

  • Size

    98.9MB

  • Sample

    241002-kef9hazglf

  • MD5

    264643fa4fb1783f1c6dd54cebe99d57

  • SHA1

    c244c68ca4368f4140691cbe2360232a567b6c3a

  • SHA256

    318e60129bf258c68127a42683b26d4cbf4748e0de4faa212c186e68eee497b0

  • SHA512

    0731de7f911629e7da21165db0b5652e81e5b98d93ee0be24ca878f7e9950efc02cd6e5377bed9bc311e937af9ae3c62b440cbe0c9ecf901b10db6547ae47932

  • SSDEEP

    3145728:nHr4GiY2WrJWRyCbia/VahXpfLq6yzCMpHGH:Hr+l2aM5pm3ZHG

Score
10/10
fatalrataspackv2discoveryevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      win32-quickq.exe.v

    • Size

      98.9MB

    • MD5

      264643fa4fb1783f1c6dd54cebe99d57

    • SHA1

      c244c68ca4368f4140691cbe2360232a567b6c3a

    • SHA256

      318e60129bf258c68127a42683b26d4cbf4748e0de4faa212c186e68eee497b0

    • SHA512

      0731de7f911629e7da21165db0b5652e81e5b98d93ee0be24ca878f7e9950efc02cd6e5377bed9bc311e937af9ae3c62b440cbe0c9ecf901b10db6547ae47932

    • SSDEEP

      3145728:nHr4GiY2WrJWRyCbia/VahXpfLq6yzCMpHGH:Hr+l2aM5pm3ZHG

    Score
    10/10
    fatalrataspackv2discoveryevasioninfostealerpersistencerattrojan

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks