Overview

overview

10

Static

static

3

dea981aaf4...0N.exe

windows7-x64

10

dea981aaf4...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dea981aaf4a2cce10bdc02ad863a0c00N

  • Size

    78KB

  • Sample

    240911-ny7gksycnk

  • MD5

    dea981aaf4a2cce10bdc02ad863a0c00

  • SHA1

    5dba73213a7d5e5dbd93c78b40580d9974a4c43f

  • SHA256

    2e1168dae7669807b8905799e3734c7a49e683db6c5fce6230a92508cf98f1ee

  • SHA512

    1af91f3fcef41ef3eb03ae71054d0a6c2a9b3c2641f2fe0ecd2bb313b22321c409336cc5b0d654f55712acb754c900ed272355a3da1c1a14352412f31b77620d

  • SSDEEP

    1536:WPWtHHM7t/vZv0kH9gDDtWzYCnJPeoYrGQtt9/d1U6:WPWtHsh/l0Y9MDYrm7t9/n

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      dea981aaf4a2cce10bdc02ad863a0c00N

    • Size

      78KB

    • MD5

      dea981aaf4a2cce10bdc02ad863a0c00

    • SHA1

      5dba73213a7d5e5dbd93c78b40580d9974a4c43f

    • SHA256

      2e1168dae7669807b8905799e3734c7a49e683db6c5fce6230a92508cf98f1ee

    • SHA512

      1af91f3fcef41ef3eb03ae71054d0a6c2a9b3c2641f2fe0ecd2bb313b22321c409336cc5b0d654f55712acb754c900ed272355a3da1c1a14352412f31b77620d

    • SSDEEP

      1536:WPWtHHM7t/vZv0kH9gDDtWzYCnJPeoYrGQtt9/d1U6:WPWtHsh/l0Y9MDYrm7t9/n

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks