Overview

overview

10

Static

static

3

ca210e0689...a2.exe

windows7-x64

10

ca210e0689...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca210e068987b172434c1b99cb6f5f56fba99b3bccf5ff4c4e8cd170c7b9a8a2

  • Size

    6.1MB

  • Sample

    241211-gy7n1svpgr

  • MD5

    052072ffc4f8449345ceea343fdee0a7

  • SHA1

    c64f1e6fa8b7ebcbda234f4534fbf654b0a4850c

  • SHA256

    ca210e068987b172434c1b99cb6f5f56fba99b3bccf5ff4c4e8cd170c7b9a8a2

  • SHA512

    1703513639446cc7c72142571f3016032df27346c09b2da1a5b35e51b814f27e4f13599702338e884182f578eef7f32d90d165732238c45f26523a88f9737f97

  • SSDEEP

    98304:AAymlFX/ZL1K4WIqBI4rpNBczHA65wtX5bBeNz26AG1jQiWHugB9:AAhlFRLchIqBfz82XN8N6OjQr

Score
10/10
fatalratgh0stratdefense_evasiondiscoveryinfostealerratupx

Malware Config

Targets

    • Target

      ca210e068987b172434c1b99cb6f5f56fba99b3bccf5ff4c4e8cd170c7b9a8a2

    • Size

      6.1MB

    • MD5

      052072ffc4f8449345ceea343fdee0a7

    • SHA1

      c64f1e6fa8b7ebcbda234f4534fbf654b0a4850c

    • SHA256

      ca210e068987b172434c1b99cb6f5f56fba99b3bccf5ff4c4e8cd170c7b9a8a2

    • SHA512

      1703513639446cc7c72142571f3016032df27346c09b2da1a5b35e51b814f27e4f13599702338e884182f578eef7f32d90d165732238c45f26523a88f9737f97

    • SSDEEP

      98304:AAymlFX/ZL1K4WIqBI4rpNBczHA65wtX5bBeNz26AG1jQiWHugB9:AAhlFRLchIqBfz82XN8N6OjQr

    Score
    10/10
    fatalratdefense_evasiondiscoveryinfostealerratgh0stratupx

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      infostealerratfatalrat

    • Fatalrat family

      fatalrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Fatal Rat payload

      ratinfostealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks