Overview

overview

10

Static

static

3

NEAS.baac9...40.exe

windows7-x64

10

NEAS.baac9...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.baac9206225f41b4e88956f9151cc840.exe

  • Size

    78KB

  • Sample

    231101-e3ta3sad5s

  • MD5

    baac9206225f41b4e88956f9151cc840

  • SHA1

    0a1b700b6cfa809c544b538986b0164a64d97a39

  • SHA256

    e8ca724de0fef61db7210c306efd5c7793fb20daa3e17852604574a9a77711d6

  • SHA512

    1b89451e85d88bb342c364689e1bbbefdc5caaf56760ec27bd571f8aa42ed9aceb46ce5e4eb85c7b5242692b397b4b0a4744842ac82df4d7b108cb6b3b7cef51

  • SSDEEP

    1536:d4V5jSfVdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQtC6769/cz1cp:d4V5jSf/vqyA11XYUBxprBPjcj69/H

Score
10/10
metamorpherratpersistenceratstealertrojan

Malware Config

Targets

    • Target

      NEAS.baac9206225f41b4e88956f9151cc840.exe

    • Size

      78KB

    • MD5

      baac9206225f41b4e88956f9151cc840

    • SHA1

      0a1b700b6cfa809c544b538986b0164a64d97a39

    • SHA256

      e8ca724de0fef61db7210c306efd5c7793fb20daa3e17852604574a9a77711d6

    • SHA512

      1b89451e85d88bb342c364689e1bbbefdc5caaf56760ec27bd571f8aa42ed9aceb46ce5e4eb85c7b5242692b397b4b0a4744842ac82df4d7b108cb6b3b7cef51

    • SSDEEP

      1536:d4V5jSfVdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQtC6769/cz1cp:d4V5jSf/vqyA11XYUBxprBPjcj69/H

    Score
    10/10
    metamorpherratpersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks