General

  • Target

    1f4a02915bf976265c54961100224a3b0f42bf1f0a90e20b05a7ef9f7c28e256

  • Size

    78KB

  • Sample

    240406-xwnq5ahb78

  • MD5

    9a506d7e4b18617e01a88ae82df1c50b

  • SHA1

    336b0d83c0b3664cc208b5a04efc633904e261e9

  • SHA256

    1f4a02915bf976265c54961100224a3b0f42bf1f0a90e20b05a7ef9f7c28e256

  • SHA512

    2d897c57d9ee7aac44e4c25c3687a329913d388ffc3c82bf9d93749c8ecef24ac14b8631297fb92a9277cf932004b5a76a58a4781e63e7306b48a8d4fe10b34c

  • SSDEEP

    1536:LPWtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtV9/01rg:LPWtHFq3Ln7N041QqhgV9/R

Malware Config

Targets

    • Target

      1f4a02915bf976265c54961100224a3b0f42bf1f0a90e20b05a7ef9f7c28e256

    • Size

      78KB

    • MD5

      9a506d7e4b18617e01a88ae82df1c50b

    • SHA1

      336b0d83c0b3664cc208b5a04efc633904e261e9

    • SHA256

      1f4a02915bf976265c54961100224a3b0f42bf1f0a90e20b05a7ef9f7c28e256

    • SHA512

      2d897c57d9ee7aac44e4c25c3687a329913d388ffc3c82bf9d93749c8ecef24ac14b8631297fb92a9277cf932004b5a76a58a4781e63e7306b48a8d4fe10b34c

    • SSDEEP

      1536:LPWtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtV9/01rg:LPWtHFq3Ln7N041QqhgV9/R

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks