Overview

overview

10

Static

static

15a91a73d3...4c.exe

windows7_x64

10

15a91a73d3...4c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15a91a73d34c70be3ae427e2f296d79848ac15326f4d32e1e08831db651aa64c

  • Size

    584KB

  • Sample

    220511-c5ybpsgehn

  • MD5

    d21695b6d9bdd7ed0e35a0c70ce38205

  • SHA1

    33522e95507f48e68a981b1097bcbe0354e31c1a

  • SHA256

    15a91a73d34c70be3ae427e2f296d79848ac15326f4d32e1e08831db651aa64c

  • SHA512

    0550e12024173c5a369ca28f20042756d2a5a83025e8fe22e89d5f5712232741ba5c090ea53406a20372b6666a98aa23eb896e3cfb61797401b7591b9c587a5f

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      15a91a73d34c70be3ae427e2f296d79848ac15326f4d32e1e08831db651aa64c

    • Size

      584KB

    • MD5

      d21695b6d9bdd7ed0e35a0c70ce38205

    • SHA1

      33522e95507f48e68a981b1097bcbe0354e31c1a

    • SHA256

      15a91a73d34c70be3ae427e2f296d79848ac15326f4d32e1e08831db651aa64c

    • SHA512

      0550e12024173c5a369ca28f20042756d2a5a83025e8fe22e89d5f5712232741ba5c090ea53406a20372b6666a98aa23eb896e3cfb61797401b7591b9c587a5f

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks