Overview

overview

10

Static

static

93976f0e20...dd.exe

windows7_x64

10

93976f0e20...dd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93976f0e20d71604b9d3cb4de0046d874f763aa9ef701ef65feaa5d4a8152bdd

  • Size

    333KB

  • Sample

    220415-llc14afghj

  • MD5

    c9fbb0b249181bda2fd97576a58e9292

  • SHA1

    e0e64d6903b514ac554b59d2b082b04d8f1df46b

  • SHA256

    93976f0e20d71604b9d3cb4de0046d874f763aa9ef701ef65feaa5d4a8152bdd

  • SHA512

    1750c75df8b99ddd88f998a8136fb151af8804ea2f29cba2af5651948788a0e20a0623bbc0e313b281b0f11aefafb14c34cb09c11b8b5e24ed0230260bf9eca9

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      93976f0e20d71604b9d3cb4de0046d874f763aa9ef701ef65feaa5d4a8152bdd

    • Size

      333KB

    • MD5

      c9fbb0b249181bda2fd97576a58e9292

    • SHA1

      e0e64d6903b514ac554b59d2b082b04d8f1df46b

    • SHA256

      93976f0e20d71604b9d3cb4de0046d874f763aa9ef701ef65feaa5d4a8152bdd

    • SHA512

      1750c75df8b99ddd88f998a8136fb151af8804ea2f29cba2af5651948788a0e20a0623bbc0e313b281b0f11aefafb14c34cb09c11b8b5e24ed0230260bf9eca9

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • HiveRAT Payload

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks