Overview

overview

10

Static

static

93eb342b1d...63.exe

windows7_x64

10

93eb342b1d...63.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93eb342b1d21e99bfe5a88dfef65c886018dc120cd86310a893c77faeceb5063

  • Size

    440KB

  • Sample

    220503-y83w9aeegp

  • MD5

    18173a14dda8acb4faec79500b81083f

  • SHA1

    0a5324267c4d4befdd89add3c1d8d9c467a85902

  • SHA256

    93eb342b1d21e99bfe5a88dfef65c886018dc120cd86310a893c77faeceb5063

  • SHA512

    aa3fc2bf78430ead7177592c58dccaa5fd4ad001e19d195d5fd387b791414c9aad39fb8ea7aff5c303a12f37fc4a94f094de18f7de8119deb890814526c5187a

Score
10/10
hiveratpersistenceratstealer

Malware Config

Targets

    • Target

      93eb342b1d21e99bfe5a88dfef65c886018dc120cd86310a893c77faeceb5063

    • Size

      440KB

    • MD5

      18173a14dda8acb4faec79500b81083f

    • SHA1

      0a5324267c4d4befdd89add3c1d8d9c467a85902

    • SHA256

      93eb342b1d21e99bfe5a88dfef65c886018dc120cd86310a893c77faeceb5063

    • SHA512

      aa3fc2bf78430ead7177592c58dccaa5fd4ad001e19d195d5fd387b791414c9aad39fb8ea7aff5c303a12f37fc4a94f094de18f7de8119deb890814526c5187a

    Score
    10/10
    hiveratpersistenceratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks