Extracted

• • Target
    xtswpssxti2.65.msi
  • Size 66.3MB
  • SHA256 7637a316f0b40eedb840ad41a3e56db7b9432b54c03508774d99747ec44a85f1
  • MD5 7eaef33038b93b97eefe0b83d48fb839
  • SHA1 3194b5de4907fad3de70612b12b5fe6031c11ed8
  • SHA512 c2be54b55a1eeeb9ac71d401e10a883239233d3501961535ea9ef5fbe33e22e7d13490c8570d44239dae899551687b41fd893af0bd4c2e47a4aac7782a0d64b2
  • SSDEEP 1572864:TbLMPeOHt2IlpfU7VFlggSwAy8ZoQ4waKwGGB8iAP:/LMPT/kVF2wA3h4cJGBJK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bootkitdefense_evasiondiscoveryfatalratinfostealerpersistenceprivilege_escalationransomwareratstealertrojanupxvmprotect

  • Fatal Rat payload

    ratinfostealer

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    stealertrojanfatalrat

  • Fatalrat family

    fatalrat

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2