Overview

overview

10

Static

static

1818a00c19...bd.exe

windows7_x64

10

1818a00c19...bd.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd

  • Size

    364KB

  • Sample

    220511-c4txwsgeej

  • MD5

    9af2b3841221ccb778c03f8535853d59

  • SHA1

    80fac73976ca4b7978d7ec8cb9a6962347cea18a

  • SHA256

    1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd

  • SHA512

    ae55d19c3cec653074dbf46ff313ee55d68297c6b6fd2ef9d24730cf7094f59a62621e6a59c5ca6ffce071bd57fd61d95ab32580d01b6a1c439b6cb7ce59cc04

Score
10/10
hiveratpersistenceratstealer

Malware Config

Targets

    • Target

      1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd

    • Size

      364KB

    • MD5

      9af2b3841221ccb778c03f8535853d59

    • SHA1

      80fac73976ca4b7978d7ec8cb9a6962347cea18a

    • SHA256

      1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd

    • SHA512

      ae55d19c3cec653074dbf46ff313ee55d68297c6b6fd2ef9d24730cf7094f59a62621e6a59c5ca6ffce071bd57fd61d95ab32580d01b6a1c439b6cb7ce59cc04

    Score
    10/10
    hiveratpersistenceratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks