Overview

overview

10

Static

static

3

be5c742d41...7N.exe

windows7-x64

10

be5c742d41...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be5c742d41fa69c0c3a266fc8a57cea4a7c5f297e2c3d5d6f2af125f29fdab17N

  • Size

    78KB

  • Sample

    240920-bjzf7s1cjc

  • MD5

    45309cbe21e9ffdb1313d47c9e06a250

  • SHA1

    1029e05ccbd273fe37dbb0f87e3831547d88040b

  • SHA256

    be5c742d41fa69c0c3a266fc8a57cea4a7c5f297e2c3d5d6f2af125f29fdab17

  • SHA512

    0f87e54c93f765afffd9761c9526cc12dc4fe3cdb8313d0436f3e5fb726cbe02bb9f994d95802f97534b3fc41c7acee0601748db042682d50c668b338e294757

  • SSDEEP

    1536:UCHHM7t/vZv0kH9gDDtWzYCnJPeoYrGQt1th9/31nc:UCHsh/l0Y9MDYrm71r9/u

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      be5c742d41fa69c0c3a266fc8a57cea4a7c5f297e2c3d5d6f2af125f29fdab17N

    • Size

      78KB

    • MD5

      45309cbe21e9ffdb1313d47c9e06a250

    • SHA1

      1029e05ccbd273fe37dbb0f87e3831547d88040b

    • SHA256

      be5c742d41fa69c0c3a266fc8a57cea4a7c5f297e2c3d5d6f2af125f29fdab17

    • SHA512

      0f87e54c93f765afffd9761c9526cc12dc4fe3cdb8313d0436f3e5fb726cbe02bb9f994d95802f97534b3fc41c7acee0601748db042682d50c668b338e294757

    • SSDEEP

      1536:UCHHM7t/vZv0kH9gDDtWzYCnJPeoYrGQt1th9/31nc:UCHsh/l0Y9MDYrm71r9/u

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks