fatalrat

General

Target

970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3
Size

892KB
Sample

250217-qjlbxayrfr
MD5

7a96cacfa36023763cd276819c1be778
SHA1

2c087b1688bcaffba3426de47a0c0015a6b4d070
SHA256

970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3
SHA512

27a1f43bb68d353fdd4a9f815a53357d9001dd408be01043c211483ed5839621b31ec57719b18c070011100c541b22508127714af763ef7af7d763d2ac15f7a7
SSDEEP

24576:tZe29SCZcl/upox/R5zGjedEu8j8KDTbKAkw:tBZcl/uu/RIjedEu83fbAw

Score

10^/10

Malware Config

Targets

- Target
  
  970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3
- Size
  
  892KB
- MD5
  
  7a96cacfa36023763cd276819c1be778
- SHA1
  
  2c087b1688bcaffba3426de47a0c0015a6b4d070
- SHA256
  
  970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3
- SHA512
  
  27a1f43bb68d353fdd4a9f815a53357d9001dd408be01043c211483ed5839621b31ec57719b18c070011100c541b22508127714af763ef7af7d763d2ac15f7a7
- SSDEEP
  
  24576:tZe29SCZcl/upox/R5zGjedEu8j8KDTbKAkw:tBZcl/uu/RIjedEu83fbAw
Score

10^/10

fatalrat discovery infostealer rat stealer trojan adware persistence privilege_escalation
- FatalRat
  FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
  stealer trojan fatalrat
- Fatalrat family
  fatalrat
- Fatal Rat payload
  rat infostealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2