Overview

overview

10

Static

static

75028b8f62...3f.exe

windows7_x64

10

75028b8f62...3f.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f

  • Size

    78KB

  • Sample

    220330-eazx6affe9

  • MD5

    00b01e3ae42a148b96973f119918429e

  • SHA1

    6c07708b750ff2e650ab3845544b138b65a597c4

  • SHA256

    75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f

  • SHA512

    899d5fabfa77d237e533615b10bd659965ffd212f015e6a8dbf6bd729a0c0b0af29a05db41721182987ffdd8dd1be72cb352577c53baf12fd49280fe62b338a0

Score
10/10
metamorpherratpersistenceratstealertrojan

Malware Config

Targets

    • Target

      75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f

    • Size

      78KB

    • MD5

      00b01e3ae42a148b96973f119918429e

    • SHA1

      6c07708b750ff2e650ab3845544b138b65a597c4

    • SHA256

      75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f

    • SHA512

      899d5fabfa77d237e533615b10bd659965ffd212f015e6a8dbf6bd729a0c0b0af29a05db41721182987ffdd8dd1be72cb352577c53baf12fd49280fe62b338a0

    Score
    10/10
    metamorpherratpersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks