Overview

overview

10

Static

static

3

7554e6a296...65.exe

windows7-x64

10

7554e6a296...65.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7554e6a296a2c7a7cf558b56ad0d717c28cc8f25caecce2a2628a6ba507d9465

  • Size

    78KB

  • Sample

    240924-2tahyazemq

  • MD5

    c02a82f244939360afacbea0f5d7e283

  • SHA1

    3f2b0c5be1aad4161bc186448614fdea58cad406

  • SHA256

    7554e6a296a2c7a7cf558b56ad0d717c28cc8f25caecce2a2628a6ba507d9465

  • SHA512

    57e3b695f2493f0a5b6fd60d99a2804067f2ef500d277b1137ee2e73c1d2c87dabd4dfb9c184ba13016893c804a0cd1197be402fa20e92ab04d91fb4aaf031ba

  • SSDEEP

    1536:+V5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6n9/P1G8:+V5jS4SyRxvhTzXPvCbW2Uv9/t

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      7554e6a296a2c7a7cf558b56ad0d717c28cc8f25caecce2a2628a6ba507d9465

    • Size

      78KB

    • MD5

      c02a82f244939360afacbea0f5d7e283

    • SHA1

      3f2b0c5be1aad4161bc186448614fdea58cad406

    • SHA256

      7554e6a296a2c7a7cf558b56ad0d717c28cc8f25caecce2a2628a6ba507d9465

    • SHA512

      57e3b695f2493f0a5b6fd60d99a2804067f2ef500d277b1137ee2e73c1d2c87dabd4dfb9c184ba13016893c804a0cd1197be402fa20e92ab04d91fb4aaf031ba

    • SSDEEP

      1536:+V5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6n9/P1G8:+V5jS4SyRxvhTzXPvCbW2Uv9/t

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks