Overview

overview

10

Static

static

3

94cab3a659...0N.exe

windows7-x64

7

94cab3a659...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94cab3a6598155dea44657d97e15eed0N.exe

  • Size

    78KB

  • Sample

    240822-ddh85sydrp

  • MD5

    94cab3a6598155dea44657d97e15eed0

  • SHA1

    96f2bdf792c6e636e731e90a41de952550864f77

  • SHA256

    7011e195c7a03a1cfcc14ba4d9ae4a565bfcd88193986f0bd1e6372730700ac6

  • SHA512

    d0b6f1b647664ece11cdb95141397c693a71f0133342a8ee1859f92ab4bf4c85acada59c0f30c7448da72f002fb1c297b883b5adc79b4879ba9944c07f3ca9f1

  • SSDEEP

    1536:nPWV5j7XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6O9/wyj1TL:nPWV5j7SyRxvY3md+dWWZym9/HB

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      94cab3a6598155dea44657d97e15eed0N.exe

    • Size

      78KB

    • MD5

      94cab3a6598155dea44657d97e15eed0

    • SHA1

      96f2bdf792c6e636e731e90a41de952550864f77

    • SHA256

      7011e195c7a03a1cfcc14ba4d9ae4a565bfcd88193986f0bd1e6372730700ac6

    • SHA512

      d0b6f1b647664ece11cdb95141397c693a71f0133342a8ee1859f92ab4bf4c85acada59c0f30c7448da72f002fb1c297b883b5adc79b4879ba9944c07f3ca9f1

    • SSDEEP

      1536:nPWV5j7XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6O9/wyj1TL:nPWV5j7SyRxvY3md+dWWZym9/HB

    Score
    10/10
    discoverypersistencemetamorpherratratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks