Overview

overview

10

Static

static

d2effe6b2d...85.exe

windows7_x64

10

d2effe6b2d...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2effe6b2d255c1387d95ef4db27b501b8092e968da23015ea165d95a8d52e85

  • Size

    8.8MB

  • Sample

    220414-rahebsbegp

  • MD5

    8c50928169538c02e83da48cbebdd074

  • SHA1

    6565e179585ded5eeff78b6015a70eaef392d36c

  • SHA256

    d2effe6b2d255c1387d95ef4db27b501b8092e968da23015ea165d95a8d52e85

  • SHA512

    50f9c5f9708d6ad52d6e9cd61ac3031e833853134d1e66c43744f311dc64fb48a04af7a5bf197a1bb7d9a6d26f44bdf52080d1a59fca1ca4e8b816a2d7ac6d2c

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      d2effe6b2d255c1387d95ef4db27b501b8092e968da23015ea165d95a8d52e85

    • Size

      8.8MB

    • MD5

      8c50928169538c02e83da48cbebdd074

    • SHA1

      6565e179585ded5eeff78b6015a70eaef392d36c

    • SHA256

      d2effe6b2d255c1387d95ef4db27b501b8092e968da23015ea165d95a8d52e85

    • SHA512

      50f9c5f9708d6ad52d6e9cd61ac3031e833853134d1e66c43744f311dc64fb48a04af7a5bf197a1bb7d9a6d26f44bdf52080d1a59fca1ca4e8b816a2d7ac6d2c

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks