Overview

overview

10

Static

static

c3e3246dd5...9d.exe

windows7_x64

10

c3e3246dd5...9d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3e3246dd521e246f96bef26ce813fce5f566140e45fc049c0467c2a8382719d

  • Size

    811KB

  • Sample

    220326-pje98acee2

  • MD5

    8f4ace45db5383c411aaa2773cd11bb4

  • SHA1

    f1fbdba7c16488d14cba546568e61d0a46390dfc

  • SHA256

    c3e3246dd521e246f96bef26ce813fce5f566140e45fc049c0467c2a8382719d

  • SHA512

    134d39f9b4dd215028444b7aff0c2299a5b424cbbdd915a5fcf393d154e349e17c8e7ba38fa6380de698f241b982aa2140ee07bea167a66d31416f6964a9f76e

Score
10/10
hiveratpersistenceratstealer

Malware Config

Targets

    • Target

      c3e3246dd521e246f96bef26ce813fce5f566140e45fc049c0467c2a8382719d

    • Size

      811KB

    • MD5

      8f4ace45db5383c411aaa2773cd11bb4

    • SHA1

      f1fbdba7c16488d14cba546568e61d0a46390dfc

    • SHA256

      c3e3246dd521e246f96bef26ce813fce5f566140e45fc049c0467c2a8382719d

    • SHA512

      134d39f9b4dd215028444b7aff0c2299a5b424cbbdd915a5fcf393d154e349e17c8e7ba38fa6380de698f241b982aa2140ee07bea167a66d31416f6964a9f76e

    Score
    10/10
    hiveratpersistenceratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks