Overview

overview

10

Static

static

3

f22636bfba...0N.exe

windows7-x64

10

f22636bfba...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f22636bfbaf78a0ede095307e2849de0N.exe

  • Size

    78KB

  • Sample

    240804-ssprssybjp

  • MD5

    f22636bfbaf78a0ede095307e2849de0

  • SHA1

    359529e2ec8ab551a245bad2687a03ddea27082d

  • SHA256

    f30c91f9f1507ed81cbbd900b2162a813e114cc152ef4ee513d3abcd221427d1

  • SHA512

    011614e69968460f8dc83b606d2783da46501330da5329eac8270c500ca338f77b25bb12cb9344c0ec557f5fafd656dd397d5e1917cc2ad1df2ce44f8ef5c857

  • SSDEEP

    1536:2tHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt/B9/9+1ZD:2tHshASyRxvhTzXPvCbW2U/B9/I

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      f22636bfbaf78a0ede095307e2849de0N.exe

    • Size

      78KB

    • MD5

      f22636bfbaf78a0ede095307e2849de0

    • SHA1

      359529e2ec8ab551a245bad2687a03ddea27082d

    • SHA256

      f30c91f9f1507ed81cbbd900b2162a813e114cc152ef4ee513d3abcd221427d1

    • SHA512

      011614e69968460f8dc83b606d2783da46501330da5329eac8270c500ca338f77b25bb12cb9344c0ec557f5fafd656dd397d5e1917cc2ad1df2ce44f8ef5c857

    • SSDEEP

      1536:2tHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt/B9/9+1ZD:2tHshASyRxvhTzXPvCbW2U/B9/I

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks