Overview

overview

10

Static

static

2f26ea19a8...bf.exe

windows7_x64

10

2f26ea19a8...bf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f26ea19a8fdb167b8593e8eec03c37248b6e5008f0b9ee5fb7d326cbe6500bf

  • Size

    743KB

  • Sample

    210228-1dwrxmhpcj

  • MD5

    b9000bb1ebd5843afc9f524c5b2b4cb0

  • SHA1

    9ce98360d731abf87c11c535184c57095bdb70ce

  • SHA256

    2f26ea19a8fdb167b8593e8eec03c37248b6e5008f0b9ee5fb7d326cbe6500bf

  • SHA512

    e714c718a21cc2090c8b6d829dfa2c23d9543c37dbc9383b9c5126d071e98a389ef1a45fbf71087a2574a9defd23f3996eb50e3507fcc3acb786da1beb33cef5

Score
10/10
hiveratagilenetpersistenceratstealer

Malware Config

Targets

    • Target

      2f26ea19a8fdb167b8593e8eec03c37248b6e5008f0b9ee5fb7d326cbe6500bf

    • Size

      743KB

    • MD5

      b9000bb1ebd5843afc9f524c5b2b4cb0

    • SHA1

      9ce98360d731abf87c11c535184c57095bdb70ce

    • SHA256

      2f26ea19a8fdb167b8593e8eec03c37248b6e5008f0b9ee5fb7d326cbe6500bf

    • SHA512

      e714c718a21cc2090c8b6d829dfa2c23d9543c37dbc9383b9c5126d071e98a389ef1a45fbf71087a2574a9defd23f3996eb50e3507fcc3acb786da1beb33cef5

    Score
    10/10
    hiveratagilenetpersistenceratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks