fatalrat

General

Target

10fcac9285f4886bcc99b44ea25dd264ff397e2d488a0e1bc161a950411b9613
Size

1.1MB
Sample

241212-amcaeatmcx
MD5

057da95d1934784ceaaa5b0229538497
SHA1

745d0853562bc9cbe964bc100b6cdce18112fdf0
SHA256

10fcac9285f4886bcc99b44ea25dd264ff397e2d488a0e1bc161a950411b9613
SHA512

505ff79fb6034376de174bb347cc01c2af9bbec9acc270daf41b8945a280dc3d863cb811b3d3f8198bd318d7fbaddf19685cf9a069833c5cdeadaf9ed4ab80ee
SSDEEP

24576:8HojlSSKXUne4vmOmU8tpJKI12CiwGo8YyvmWP61TkP6hEW:8H0lSSKX+XvnG/1EPDBvmWPhP4EW

Score

10^/10

Malware Config

Targets

- Target
  
  10fcac9285f4886bcc99b44ea25dd264ff397e2d488a0e1bc161a950411b9613
- Size
  
  1.1MB
- MD5
  
  057da95d1934784ceaaa5b0229538497
- SHA1
  
  745d0853562bc9cbe964bc100b6cdce18112fdf0
- SHA256
  
  10fcac9285f4886bcc99b44ea25dd264ff397e2d488a0e1bc161a950411b9613
- SHA512
  
  505ff79fb6034376de174bb347cc01c2af9bbec9acc270daf41b8945a280dc3d863cb811b3d3f8198bd318d7fbaddf19685cf9a069833c5cdeadaf9ed4ab80ee
- SSDEEP
  
  24576:8HojlSSKXUne4vmOmU8tpJKI12CiwGo8YyvmWP61TkP6hEW:8H0lSSKX+XvnG/1EPDBvmWPhP4EW
Score

10^/10

fatalrat discovery infostealer rat
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  infostealer rat fatalrat
- Fatalrat family
  fatalrat
- Fatal Rat payload
  rat infostealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Fatalrat family

Fatal Rat payload

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2