Overview

overview

10

Static

static

42a01680e2...c7.exe

windows7_x64

10

42a01680e2...c7.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42a01680e2d93f166d3d4f0b2fa5a7dde0a95ae6f4619ada35a09b159e39bcc7

  • Size

    78KB

  • Sample

    220330-j39ehsaea7

  • MD5

    064cbba3999115606171c67ed6276612

  • SHA1

    08e7c01df3f818b40bfce13df863b7c43f7e5dc0

  • SHA256

    42a01680e2d93f166d3d4f0b2fa5a7dde0a95ae6f4619ada35a09b159e39bcc7

  • SHA512

    ea18695943cc5b0d85aa59882d46b8ef49f4e6631c6dfb5b7fc7b1dabf31748080a6c77f81a147d710bbf5e508033c52d462ab21eff09a487ca766b8cb5dcbee

Score
10/10
metamorpherratpersistenceratstealertrojan

Malware Config

Targets

    • Target

      42a01680e2d93f166d3d4f0b2fa5a7dde0a95ae6f4619ada35a09b159e39bcc7

    • Size

      78KB

    • MD5

      064cbba3999115606171c67ed6276612

    • SHA1

      08e7c01df3f818b40bfce13df863b7c43f7e5dc0

    • SHA256

      42a01680e2d93f166d3d4f0b2fa5a7dde0a95ae6f4619ada35a09b159e39bcc7

    • SHA512

      ea18695943cc5b0d85aa59882d46b8ef49f4e6631c6dfb5b7fc7b1dabf31748080a6c77f81a147d710bbf5e508033c52d462ab21eff09a487ca766b8cb5dcbee

    Score
    10/10
    metamorpherratpersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks