Overview

overview

10

Static

static

199ebb6c60...87.exe

windows7_x64

10

199ebb6c60...87.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    199ebb6c60b2f902613473a7b67552e5f1c3848ed0b55b0bb3d618362369f387

  • Size

    308KB

  • Sample

    220512-n4rcjsgcfp

  • MD5

    54a02706c15bf0dddb9d35bf58a526ba

  • SHA1

    7d2001110e9d32c66306c4269ef272dc75b3da0b

  • SHA256

    199ebb6c60b2f902613473a7b67552e5f1c3848ed0b55b0bb3d618362369f387

  • SHA512

    2ed63cd8ea52a2a084caba9f883cf926c71a8b097fc5e55977dcd3b62a5e26369df28a68f96e21e29e60a83affba6085c8e968a6fa6a9afc5c7c2dfe0471f25f

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      199ebb6c60b2f902613473a7b67552e5f1c3848ed0b55b0bb3d618362369f387

    • Size

      308KB

    • MD5

      54a02706c15bf0dddb9d35bf58a526ba

    • SHA1

      7d2001110e9d32c66306c4269ef272dc75b3da0b

    • SHA256

      199ebb6c60b2f902613473a7b67552e5f1c3848ed0b55b0bb3d618362369f387

    • SHA512

      2ed63cd8ea52a2a084caba9f883cf926c71a8b097fc5e55977dcd3b62a5e26369df28a68f96e21e29e60a83affba6085c8e968a6fa6a9afc5c7c2dfe0471f25f

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • HiveRAT Payload

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks