Overview

overview

10

Static

static

3

f2167a17e7...3d.exe

windows7-x64

10

f2167a17e7...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc63856466a7bc3187c29e03d52344c92de361eb776290fce937e36075df70ac

  • Size

    58KB

  • Sample

    240831-cyx3cs1ell

  • MD5

    b076d61250f223f978d775aaaa5c2a0e

  • SHA1

    07765258df1e00d8e2dbd122ffb7624adf6c1dae

  • SHA256

    cc63856466a7bc3187c29e03d52344c92de361eb776290fce937e36075df70ac

  • SHA512

    957149ac4c107c6908ed5a15b6e9b1db506bb5bab41490978dca964e9f8ae415350f0f65a859368496bde5664edeeca0da87d16c3971d1148d48237c81906bf5

  • SSDEEP

    1536:FhOP7MeyuBk6eOrlX2HKyRsJ4YRqFNMDae:jgM8hmHFRsuYIFNMue

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      f2167a17e7bf4bc26e38a563c40d6179023978091d9407a3429645b943370e3d

    • Size

      78KB

    • MD5

      5a0e73710ba67f3fee26ca0974b30c9b

    • SHA1

      3ec0cb651838e32577d213fbb4c620cf8e496b5e

    • SHA256

      f2167a17e7bf4bc26e38a563c40d6179023978091d9407a3429645b943370e3d

    • SHA512

      d9d7e2df2d684fdcccc6cc0e002f8020ca4aa39fef63512b526f3c3db04be6f1d4e46e617ada493a7037c205a64ae500191044efc33d004d4d204c2b4868fad0

    • SSDEEP

      1536:DPWtHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt69/81EP:DPWtHshASyRxvhTzXPvCbW2U69/7

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks