Overview

overview

10

Static

static

3

b8e7f39792...ed.exe

windows7-x64

10

b8e7f39792...ed.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8e7f397929414a5cfc35f04a3448131f80a75b859135b906294197f225a51ed

  • Size

    78KB

  • Sample

    240920-18ln3s1drc

  • MD5

    91bc40189ed4720fc12f2acecf4d1891

  • SHA1

    8800564f56f16384e54b98bebfeb90d10cea65ef

  • SHA256

    b8e7f397929414a5cfc35f04a3448131f80a75b859135b906294197f225a51ed

  • SHA512

    18571e7e72e74a78691f89367a502edfa974b578345574e7527a997ff61c6372096245c7e6b727a726f42991a9947c65c627b1663187e44fb403bd49dda917b6

  • SSDEEP

    1536:hXPWV5jSfAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6H9/c1n1:ZPWV5jSfAtWDDILJLovbicqOq3o+n/9k

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      b8e7f397929414a5cfc35f04a3448131f80a75b859135b906294197f225a51ed

    • Size

      78KB

    • MD5

      91bc40189ed4720fc12f2acecf4d1891

    • SHA1

      8800564f56f16384e54b98bebfeb90d10cea65ef

    • SHA256

      b8e7f397929414a5cfc35f04a3448131f80a75b859135b906294197f225a51ed

    • SHA512

      18571e7e72e74a78691f89367a502edfa974b578345574e7527a997ff61c6372096245c7e6b727a726f42991a9947c65c627b1663187e44fb403bd49dda917b6

    • SSDEEP

      1536:hXPWV5jSfAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6H9/c1n1:ZPWV5jSfAtWDDILJLovbicqOq3o+n/9k

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks