Overview

overview

10

Static

static

77fb17512b...76.exe

windows7_x64

10

77fb17512b...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77fb17512bdea82047a24a36b153ef5277e6be10c3dcd16e123468c9d7564176

  • Size

    777KB

  • Sample

    220414-pvgbnacac5

  • MD5

    47986a2c4680ebad4d32f106e97bb4e3

  • SHA1

    27c34589a258cf119090c8f121cf85a545a262c3

  • SHA256

    77fb17512bdea82047a24a36b153ef5277e6be10c3dcd16e123468c9d7564176

  • SHA512

    f81f4f301389a881710f2ec07f5aa10bbdc4b216ed9fc7be8f0faf160c95665ce829a71efe51d32f4d7a30856bb1ac8263bbc75b9dba7d3df19e20edcf0ec855

Score
10/10
hiveratmetastealerpersistenceratstealer

Malware Config

Targets

    • Target

      77fb17512bdea82047a24a36b153ef5277e6be10c3dcd16e123468c9d7564176

    • Size

      777KB

    • MD5

      47986a2c4680ebad4d32f106e97bb4e3

    • SHA1

      27c34589a258cf119090c8f121cf85a545a262c3

    • SHA256

      77fb17512bdea82047a24a36b153ef5277e6be10c3dcd16e123468c9d7564176

    • SHA512

      f81f4f301389a881710f2ec07f5aa10bbdc4b216ed9fc7be8f0faf160c95665ce829a71efe51d32f4d7a30856bb1ac8263bbc75b9dba7d3df19e20edcf0ec855

    Score
    10/10
    hiveratpersistenceratstealermetastealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

      stealermetastealer

    • HiveRAT Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks