Overview

overview

10

Static

static

3

35adc75c8f...b3.exe

windows7-x64

10

35adc75c8f...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35adc75c8fbbbc4377db7053ce205309db0bd65e78b94483f7fed34c647ca6b3

  • Size

    78KB

  • Sample

    240817-zkqsfswcme

  • MD5

    b4451d1342868b3df5aa828f123109c1

  • SHA1

    8cdcdd3473d011d03cd92705bdc1f22ca953bd97

  • SHA256

    35adc75c8fbbbc4377db7053ce205309db0bd65e78b94483f7fed34c647ca6b3

  • SHA512

    c7aaa0a5c7f1be006431b2e0dccf0da9c5db6bdcf34b732b95c96d9b202fba4f9310dafcbf1513502500596b522c7f897ddf6ad447634be22c69c03267dd63bd

  • SSDEEP

    1536:xu5jSxAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6n9/Xe1o+:45jSxAtWDDILJLovbicqOq3o+nv9/w

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      35adc75c8fbbbc4377db7053ce205309db0bd65e78b94483f7fed34c647ca6b3

    • Size

      78KB

    • MD5

      b4451d1342868b3df5aa828f123109c1

    • SHA1

      8cdcdd3473d011d03cd92705bdc1f22ca953bd97

    • SHA256

      35adc75c8fbbbc4377db7053ce205309db0bd65e78b94483f7fed34c647ca6b3

    • SHA512

      c7aaa0a5c7f1be006431b2e0dccf0da9c5db6bdcf34b732b95c96d9b202fba4f9310dafcbf1513502500596b522c7f897ddf6ad447634be22c69c03267dd63bd

    • SSDEEP

      1536:xu5jSxAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6n9/Xe1o+:45jSxAtWDDILJLovbicqOq3o+nv9/w

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks