Overview

overview

10

Static

static

c3a22233ae...95.exe

windows7_x64

3

c3a22233ae...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3a22233aee6a06d88c2190bc8dead9f9a15d370bf898d7a6a9ace9f40a6b095

  • Size

    504KB

  • Sample

    220329-w3pfkahfb5

  • MD5

    3eee2cacbdec05479d8a24989ad36713

  • SHA1

    00cb49cce05840f394f793ceeae54623e418c18b

  • SHA256

    c3a22233aee6a06d88c2190bc8dead9f9a15d370bf898d7a6a9ace9f40a6b095

  • SHA512

    d59f8e97a12fdfd2faa947e2b612e09529e6c4542f729f72b5015cb9d47eef61eb34990383cde592c692f52b5d04788b54a82132e236eb66e75d8973416b96c6

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      c3a22233aee6a06d88c2190bc8dead9f9a15d370bf898d7a6a9ace9f40a6b095

    • Size

      504KB

    • MD5

      3eee2cacbdec05479d8a24989ad36713

    • SHA1

      00cb49cce05840f394f793ceeae54623e418c18b

    • SHA256

      c3a22233aee6a06d88c2190bc8dead9f9a15d370bf898d7a6a9ace9f40a6b095

    • SHA512

      d59f8e97a12fdfd2faa947e2b612e09529e6c4542f729f72b5015cb9d47eef61eb34990383cde592c692f52b5d04788b54a82132e236eb66e75d8973416b96c6

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks