Overview

overview

10

Static

static

5

Chrome.exe

windows7-x64

10

Chrome.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5bfca14fd1270fab7d4938c493d032b836d3704cd08bacc06b67d9644cd5ef3f

  • Size

    4.5MB

  • Sample

    241017-mpws2steqh

  • MD5

    6ee4db3b0d2b0d9c139ef84c703e89c3

  • SHA1

    e7125ff9daa4fa17894abd6f73b21bae388445cc

  • SHA256

    5bfca14fd1270fab7d4938c493d032b836d3704cd08bacc06b67d9644cd5ef3f

  • SHA512

    fcf62fefd74772a39023af3c2fe1cf69d4c418c77fd46b8d67fdce55b8b8be9a4b2e0490cfaa72bf1e501a14c5d811c0a7401814eb5ecc87643509e836aafb9e

  • SSDEEP

    98304:nJShHoVzaUAB9MXa7cRGFjaPqE3vGXpUCM2cW1dXaNAMMSynJX6oIE:no+gPB9XgQFjaVfGZXM1W/KNAYyJqoT

Score
10/10
fatalrataspackv2discoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Targets

    • Target

      Chrome.exe

    • Size

      4.5MB

    • MD5

      b0b24f27fd7823afb7e2504f8bb74f0d

    • SHA1

      5cd5517b9e52666fcba2ad8044bf4a93eef9c45f

    • SHA256

      427136f3126d5e890c18c4b24823c42c10eec2653fb45c64da928888ee8dff04

    • SHA512

      e40419252d0816305072327cd8e02e7f85f0aff3e669b1c639e54f06d2c30d4763aa53a1ef7afdc79a6c960b159ec040e58da109483050aa1403d821ec5a310a

    • SSDEEP

      98304:jDNMJGPpKZ9AaI7lg/EbOL+FH29q03z/JPPoImScAlL8R4CaowrdVi0aM:jJM4UwF7l9SqFH25j/xQIJc4AR4iwhYs

    Score
    10/10
    fatalrataspackv2discoveryevasioninfostealerpersistencerattrojanupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatal Rat payload

      ratinfostealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks