Overview

overview

10

Static

static

3

e97e498aed...18.exe

windows7-x64

10

e97e498aed...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e97e498aed5d1051b758d56c1865d6b2_JaffaCakes118

  • Size

    78KB

  • Sample

    240918-tldxds1bmp

  • MD5

    e97e498aed5d1051b758d56c1865d6b2

  • SHA1

    178ffc6370c82966acff06f5b28132d9cb78fd6a

  • SHA256

    2d4187af251d2617268f6cd938c0c051c95a71026936184f64419d7faf0b82bc

  • SHA512

    74601fd303f2962643ec1cea5bd42b34350d0b8e63c69b32d8b38c1f801694236eb5af01be0ad59843427545ca047e9acf09b5ab6e7e2dd87c79fa79704d08c1

  • SSDEEP

    1536:7HFo6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtn9/B1yP:7HFon3xSyRxvY3md+dWWZyn9/4

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      e97e498aed5d1051b758d56c1865d6b2_JaffaCakes118

    • Size

      78KB

    • MD5

      e97e498aed5d1051b758d56c1865d6b2

    • SHA1

      178ffc6370c82966acff06f5b28132d9cb78fd6a

    • SHA256

      2d4187af251d2617268f6cd938c0c051c95a71026936184f64419d7faf0b82bc

    • SHA512

      74601fd303f2962643ec1cea5bd42b34350d0b8e63c69b32d8b38c1f801694236eb5af01be0ad59843427545ca047e9acf09b5ab6e7e2dd87c79fa79704d08c1

    • SSDEEP

      1536:7HFo6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtn9/B1yP:7HFon3xSyRxvY3md+dWWZyn9/4

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks