Overview

overview

10

Static

static

3

aacd49a996...bN.exe

windows7-x64

10

aacd49a996...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aacd49a99622779c5ce46c7682eb9404da1ae2aee095934fcc1be833d670015bN

  • Size

    78KB

  • Sample

    240920-ws4gqszejf

  • MD5

    41677bdefef313495032aff1edb2bec0

  • SHA1

    000c09f9fe00e6fe06ce1dbbd1f4ddaf5c74de40

  • SHA256

    aacd49a99622779c5ce46c7682eb9404da1ae2aee095934fcc1be833d670015b

  • SHA512

    79f4ce170da001bbb07db78bb2028ebfcf8b04a468f930dd8c972e3ee60e2df30bc5b9a95618f29c2f20c5ad2fe37b422d5cd004eee5c3a44e452fa0e18e4f6e

  • SSDEEP

    1536:ZRCHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtea9/b1Ij:ZRCHF8hASyRxvhTzXPvCbW2Uea9/0

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      aacd49a99622779c5ce46c7682eb9404da1ae2aee095934fcc1be833d670015bN

    • Size

      78KB

    • MD5

      41677bdefef313495032aff1edb2bec0

    • SHA1

      000c09f9fe00e6fe06ce1dbbd1f4ddaf5c74de40

    • SHA256

      aacd49a99622779c5ce46c7682eb9404da1ae2aee095934fcc1be833d670015b

    • SHA512

      79f4ce170da001bbb07db78bb2028ebfcf8b04a468f930dd8c972e3ee60e2df30bc5b9a95618f29c2f20c5ad2fe37b422d5cd004eee5c3a44e452fa0e18e4f6e

    • SSDEEP

      1536:ZRCHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtea9/b1Ij:ZRCHF8hASyRxvhTzXPvCbW2Uea9/0

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks