metamorpherrat | 165f560e66f15904d6ae4f150247ba95b3d989e1f0ed033e65a700ee3b62ea14 | Triage

Sharing

General

Target

165f560e66f15904d6ae4f150247ba95b3d989e1f0ed033e65a700ee3b62ea14N
Size

78KB
Sample

240928-r7wcfs1emj
MD5

85d106dfe2b38575d440f49eff457ba0
SHA1

eed23005ed3ac32c6a123193ee82c3fd51495efd
SHA256

165f560e66f15904d6ae4f150247ba95b3d989e1f0ed033e65a700ee3b62ea14
SHA512

b5e19872849067f0db3d7e1b0b84b183e81d0372abde950a8bf786158a9e9c55757ab49d4e24756e3ddf83ef2d775801944896e646b30dc01649464c577c563f
SSDEEP

1536:7c5rXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6N9/Y1Td:7c5rSyRxvhTzXPvCbW2UF9/g

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Targets

- Target
  
  165f560e66f15904d6ae4f150247ba95b3d989e1f0ed033e65a700ee3b62ea14N
- Size
  
  78KB
- MD5
  
  85d106dfe2b38575d440f49eff457ba0
- SHA1
  
  eed23005ed3ac32c6a123193ee82c3fd51495efd
- SHA256
  
  165f560e66f15904d6ae4f150247ba95b3d989e1f0ed033e65a700ee3b62ea14
- SHA512
  
  b5e19872849067f0db3d7e1b0b84b183e81d0372abde950a8bf786158a9e9c55757ab49d4e24756e3ddf83ef2d775801944896e646b30dc01649464c577c563f
- SSDEEP
  
  1536:7c5rXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6N9/Y1Td:7c5rSyRxvhTzXPvCbW2UF9/g
Score

10^/10

metamorpherrat discovery persistence rat stealer trojan
- MetamorpherRAT
  Metamorpherrat is a hacking tool that has been around for a while since 2013.
  trojan rat stealer metamorpherrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metamorpherratdiscoverypersistenceratstealertrojan

behavioral2

metamorpherratdiscoverypersistenceratstealertrojan