Overview

overview

10

Static

static

faedba78d7...6d.exe

windows7_x64

10

faedba78d7...6d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faedba78d76455d390dcc0588860d6016f875d7c844ab7f954894b6843cecf6d

  • Size

    236KB

  • Sample

    220524-z4qa2accbn

  • MD5

    2db12e4adb813900423f57caa32435c2

  • SHA1

    cb2627fcef6e94699aa325cdd7428257cabcb93f

  • SHA256

    faedba78d76455d390dcc0588860d6016f875d7c844ab7f954894b6843cecf6d

  • SHA512

    fc7334905db1348c3ba346edca12f51b1e59fcb43c4eef19f1e546e18c201d76cadcf2088f15a33f269b04a4034b48668028735071ec726b576d0cbb25a8d048

Score
10/10
hiveratratstealer

Malware Config

Targets

    • Target

      faedba78d76455d390dcc0588860d6016f875d7c844ab7f954894b6843cecf6d

    • Size

      236KB

    • MD5

      2db12e4adb813900423f57caa32435c2

    • SHA1

      cb2627fcef6e94699aa325cdd7428257cabcb93f

    • SHA256

      faedba78d76455d390dcc0588860d6016f875d7c844ab7f954894b6843cecf6d

    • SHA512

      fc7334905db1348c3ba346edca12f51b1e59fcb43c4eef19f1e546e18c201d76cadcf2088f15a33f269b04a4034b48668028735071ec726b576d0cbb25a8d048

    Score
    10/10
    hiveratratstealer

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • HiveRAT Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks