General

  • Target

    win32-quickq_1.exe.vir

  • Size

    98.2MB

  • Sample

    241118-gye9rszgmf

  • MD5

    b8dea70bf788929e2129e066c9c1d401

  • SHA1

    7403aa225eed41dc69dfad368db97685fbc9eb1c

  • SHA256

    e57a8d682aa0a7821d791f13f52fd5567f2dd38d4e64f7eba8d98544549d62c6

  • SHA512

    a4497706a62dc6cd39c3e0a9f7d78fb18fe3b542bcc17e5848ecf92f3dd4a798ed700e90775c12025987a91dcfcff333a5e165f2fb111b4d85b8790a5594eb28

  • SSDEEP

    3145728:48qC2GLfwe8O2YxkkCa+w0SPh5BU7xaszy:rPpnxKJwdJCasu

Malware Config

Targets

    • Target

      win32-quickq_1.exe.vir

    • Size

      98.2MB

    • MD5

      b8dea70bf788929e2129e066c9c1d401

    • SHA1

      7403aa225eed41dc69dfad368db97685fbc9eb1c

    • SHA256

      e57a8d682aa0a7821d791f13f52fd5567f2dd38d4e64f7eba8d98544549d62c6

    • SHA512

      a4497706a62dc6cd39c3e0a9f7d78fb18fe3b542bcc17e5848ecf92f3dd4a798ed700e90775c12025987a91dcfcff333a5e165f2fb111b4d85b8790a5594eb28

    • SSDEEP

      3145728:48qC2GLfwe8O2YxkkCa+w0SPh5BU7xaszy:rPpnxKJwdJCasu

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    • Fatalrat family

    • Fatal Rat payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks