Overview

overview

10

Static

static

3

sample.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample.exe

  • Size

    347KB

  • Sample

    250325-jlgm6swpy2

  • MD5

    fe36f9338bec464c20098dc13e9eba94

  • SHA1

    f68ec3bf7089e14791032708d45886a21acd7bca

  • SHA256

    476ff2a15d602a14c136e11141890eb0513b1090ddb2c82f0ba51f8fb6803a1b

  • SHA512

    0b7186d9eb1b7a576f316a73c8f4c77891fb6618347b5cdfecb23ee6784a3a856ade361e6adbad71059ac2b256e90e01356a30788de5574b8e905b62737c483d

  • SSDEEP

    6144:zvEN2U+T6i5LirrllHy4HUcMQY6fEGqZYGVd82PDp:zENN+T5xYrllrU7QY6fEvmedp

Score
10/10
fatalratdefense_evasiondiscoveryinfostealerpersistenceratstealertrojan

Malware Config

Targets

    • Target

      sample.exe

    • Size

      347KB

    • MD5

      fe36f9338bec464c20098dc13e9eba94

    • SHA1

      f68ec3bf7089e14791032708d45886a21acd7bca

    • SHA256

      476ff2a15d602a14c136e11141890eb0513b1090ddb2c82f0ba51f8fb6803a1b

    • SHA512

      0b7186d9eb1b7a576f316a73c8f4c77891fb6618347b5cdfecb23ee6784a3a856ade361e6adbad71059ac2b256e90e01356a30788de5574b8e905b62737c483d

    • SSDEEP

      6144:zvEN2U+T6i5LirrllHy4HUcMQY6fEGqZYGVd82PDp:zENN+T5xYrllrU7QY6fEvmedp

    Score
    10/10
    fatalratdefense_evasiondiscoveryinfostealerpersistenceratstealertrojan

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

      stealertrojanfatalrat

    • Fatalrat family

      fatalrat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      defense_evasion

    • Fatal Rat payload

      ratinfostealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks