Overview

overview

10

Static

static

fafbac3283...fc.exe

windows7_x64

10

fafbac3283...fc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fafbac3283f1c1b642284c1cee4c4111a165df2afce327798e739e1bb09984fc

  • Size

    585KB

  • Sample

    220511-c5w4msgehm

  • MD5

    bf400de7c5e0fb5fe483cb09c0ccb745

  • SHA1

    46199385eb5aeccd6638d77a980c780344ac8ace

  • SHA256

    fafbac3283f1c1b642284c1cee4c4111a165df2afce327798e739e1bb09984fc

  • SHA512

    255c6fd43bd6e8954fec5e37b9c4aef9b210728073173ac51bc5ffaa6cb3cddab32d854c027ed7c0ff3e3d311e5b8e3c5a3ed3e1e08e8ccd60449485ec9bc93d

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      fafbac3283f1c1b642284c1cee4c4111a165df2afce327798e739e1bb09984fc

    • Size

      585KB

    • MD5

      bf400de7c5e0fb5fe483cb09c0ccb745

    • SHA1

      46199385eb5aeccd6638d77a980c780344ac8ace

    • SHA256

      fafbac3283f1c1b642284c1cee4c4111a165df2afce327798e739e1bb09984fc

    • SHA512

      255c6fd43bd6e8954fec5e37b9c4aef9b210728073173ac51bc5ffaa6cb3cddab32d854c027ed7c0ff3e3d311e5b8e3c5a3ed3e1e08e8ccd60449485ec9bc93d

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks