metamorpherrat | a4ebb653eb58883dfe9944039218bcc7ffde8c37fe180152a794f4463879ea82 | Triage

Sharing

General

Target

NEAS.9bf31b83b45ffdb8d28cfa87b71509a0.exe
Size

78KB
Sample

231028-ypy4ysba35
MD5

9bf31b83b45ffdb8d28cfa87b71509a0
SHA1

d310ce49ecc4b643f059ec35a65f7c8cfae63cf9
SHA256

a4ebb653eb58883dfe9944039218bcc7ffde8c37fe180152a794f4463879ea82
SHA512

a0b625979cd6294ac2ff3a9153b1980582853703331641ea353952d00bf6e8b231c4a759aff39cde4375b35fa6c7e9e41ee4e363ef22b025aaf1d1113620144f
SSDEEP

1536:aPWtHF3uaJtVpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQtx9/X1Ze:aPWtHFP3DJywQjDgTLopLwdCFJzx9/2

Score

10^/10

metamorpherrat rat stealer trojan

Malware Config

Targets

- Target
  
  NEAS.9bf31b83b45ffdb8d28cfa87b71509a0.exe
- Size
  
  78KB
- MD5
  
  9bf31b83b45ffdb8d28cfa87b71509a0
- SHA1
  
  d310ce49ecc4b643f059ec35a65f7c8cfae63cf9
- SHA256
  
  a4ebb653eb58883dfe9944039218bcc7ffde8c37fe180152a794f4463879ea82
- SHA512
  
  a0b625979cd6294ac2ff3a9153b1980582853703331641ea353952d00bf6e8b231c4a759aff39cde4375b35fa6c7e9e41ee4e363ef22b025aaf1d1113620144f
- SSDEEP
  
  1536:aPWtHF3uaJtVpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQtx9/X1Ze:aPWtHFP3DJywQjDgTLopLwdCFJzx9/2
Score

10^/10

metamorpherrat rat stealer trojan
- MetamorpherRAT
  Metamorpherrat is a hacking tool that has been around for a while since 2013.
  trojan rat stealer metamorpherrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metamorpherratratstealertrojan

behavioral2

metamorpherratratstealertrojan