General

  • Target

    4a20d671edfa711256fe211a5f57373aed5993763da3019275349bad7ffd5f84

  • Size

    78KB

  • Sample

    220508-ybgbzsbdaq

  • MD5

    001cca8b05c60cac05f443061741fdee

  • SHA1

    fef3d6abc9c058fc5447da547e58b879dacb1bdf

  • SHA256

    4a20d671edfa711256fe211a5f57373aed5993763da3019275349bad7ffd5f84

  • SHA512

    7672454a2490485b045a5860807d07c52f1297b896f0e12d231ea2b4f37ab36307b8a84f9cdd994e677e3cda69528a73ef5d8c63832cbc6d575c9681961dfb83

Malware Config

Targets

    • Target

      4a20d671edfa711256fe211a5f57373aed5993763da3019275349bad7ffd5f84

    • Size

      78KB

    • MD5

      001cca8b05c60cac05f443061741fdee

    • SHA1

      fef3d6abc9c058fc5447da547e58b879dacb1bdf

    • SHA256

      4a20d671edfa711256fe211a5f57373aed5993763da3019275349bad7ffd5f84

    • SHA512

      7672454a2490485b045a5860807d07c52f1297b896f0e12d231ea2b4f37ab36307b8a84f9cdd994e677e3cda69528a73ef5d8c63832cbc6d575c9681961dfb83

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks