Overview

overview

10

Static

static

10

download_fin.exe

windows10-2004-x64

10

Resubmissions

19/10/2026, 11:02

261019-m45phagt2l10

28/05/2025, 07:50

250528-jplfjas1aw10

Sharing

Copy URL Twitter E-mail

General

  • Target
    download_fin.exe
  • Size 2.6MB
  • Sample261019-m45phagt2l
  • SHA256 e61e2ad639c8156f8e10ba5d91b7c364091163d15fca4ef15d71e3d56411ea5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
qatarratbobbycosturadiscoveryevasionpackerrattrojan

Malware Config

Extracted

Family

  • qatarrat

Campaign

  • Bobby

C2

  • qatar.uhdengine.com:3116

Mutex

  • Qatar_5222336196780891098002

Attributes
  • a_recovery

    false

  • ask_install

    true

  • autorun_hidden

    false

  • autorun_highest

    false

  • autorun_method

    secound

  • cblack

    false

  • cblack_list

    RU;US;DE

  • chrome_kill

    false

  • crit_process

    false

  • detect_debugger

    false

  • detect_sandboxie

    false

  • detect_small_disk

    false

  • detect_virtualization

    false

  • detect_xp

    false

  • disable_cmd

    false

  • disable_firewall

    false

  • disable_registry

    false

  • disable_run

    false

  • disable_taskmgr

    false

  • disable_uac

    false

  • disable_win_keys

    false

  • disable_windef

    true

  • hide_everything

    true

  • hide_everything_sys

    false

  • hosts_edit

    false

  • install_folder

    %appdata%

  • install_melt

    true

  • install_name

    CHROME.exe

  • install_subfolder

    ChromeDist

  • is_lotl

    false

  • is_server_var

    false

  • lib_folder

    Same

  • lib_subfolder

    QatarLib

  • name_in_tasks

    Windows Defender Update

  • need_install

    false

  • needadm

    False

  • password_var

    P@SSw0rd

  • pastebin_link

    https://pastebin.com/raw/XXXXX

  • registry_keyname

    WinUpdates

  • telegram_logs

    true

  • try_another_if_fails

    false

  • usbspr

    false

  • usbspr_name

    Qatar.exe

  • use_pastebin

    false

  • watchdog

    false

  • watchdog_loc

    %temp%

  • watchdog_name

    watchdog.vbs

Targets

    • Target
      download_fin.exe
    • Size 2.6MB
    • SHA256 e61e2ad639c8156f8e10ba5d91b7c364091163d15fca4ef15d71e3d56411ea5b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bobbydiscoveryevasionqatarratrattrojan

    • Detects QatarRAT

    • Family: QatarRAT

      QatarRAT is a Windows RAT written in C#.

      ratqatarrat

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks