Overview

overview

10

Static

static

3

0b72c0411c...cs.exe

windows7-x64

7

0b72c0411c...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe

  • Size

    78KB

  • Sample

    240526-scdplabb47

  • MD5

    0b72c0411c42339fd35e38a617954f90

  • SHA1

    63fb612b2ea4b1b4cf9861786ca82e0a99effdc3

  • SHA256

    a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27

  • SHA512

    082d7c37729e8519faa6fae4ccb8cbbd030384000c6ed0ed87d3b6a5aa3772e612252cd98ffdfcf22a68ecde5be4b0bf592e0d4a9734322bc38479e850abdc7c

  • SSDEEP

    1536:nPCHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt9/R17V:nPCHFo8dSE2EwR4uY41HyvYt9/F

Score
10/10
metamorpherratpersistenceratstealertrojan

Malware Config

Targets

    • Target

      0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe

    • Size

      78KB

    • MD5

      0b72c0411c42339fd35e38a617954f90

    • SHA1

      63fb612b2ea4b1b4cf9861786ca82e0a99effdc3

    • SHA256

      a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27

    • SHA512

      082d7c37729e8519faa6fae4ccb8cbbd030384000c6ed0ed87d3b6a5aa3772e612252cd98ffdfcf22a68ecde5be4b0bf592e0d4a9734322bc38479e850abdc7c

    • SSDEEP

      1536:nPCHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt9/R17V:nPCHFo8dSE2EwR4uY41HyvYt9/F

    Score
    10/10
    persistencemetamorpherratratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks