Overview

overview

10

Static

static

3

b2fffbe3ec...0N.exe

windows7-x64

10

b2fffbe3ec...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2fffbe3ec5f623a23275569218e95c0N

  • Size

    78KB

  • Sample

    240914-kq45psvhnm

  • MD5

    b2fffbe3ec5f623a23275569218e95c0

  • SHA1

    7725c7f995f9373f1e5d9b18f30e81203b77cf49

  • SHA256

    b7a3e95f3dd3c706412f0c9abe4a5301ad697a35d3fa96eebeab2b1b99b891bc

  • SHA512

    921ac5355617960bf687e272d90abe5aa8ba3f76223c4186d1ef06bcdb07aebc517f06b301483ef3016d620c6873f3de383a3fef4b1fe14ec7b966deeafc3a2b

  • SSDEEP

    1536:ty5jwdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6y9/b13W:ty5jfn7N041QqhgN9/Q

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      b2fffbe3ec5f623a23275569218e95c0N

    • Size

      78KB

    • MD5

      b2fffbe3ec5f623a23275569218e95c0

    • SHA1

      7725c7f995f9373f1e5d9b18f30e81203b77cf49

    • SHA256

      b7a3e95f3dd3c706412f0c9abe4a5301ad697a35d3fa96eebeab2b1b99b891bc

    • SHA512

      921ac5355617960bf687e272d90abe5aa8ba3f76223c4186d1ef06bcdb07aebc517f06b301483ef3016d620c6873f3de383a3fef4b1fe14ec7b966deeafc3a2b

    • SSDEEP

      1536:ty5jwdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6y9/b13W:ty5jfn7N041QqhgN9/Q

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks