Overview

overview

10

Static

static

3

c8b6d9a3cf...4N.exe

windows7-x64

10

c8b6d9a3cf...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8b6d9a3cfbd73dd39b8ec843de7f6de4972ea8e487072e07136351fad731ba4N

  • Size

    78KB

  • Sample

    241004-zgyznazcpa

  • MD5

    9a201d92f825795b6af400ba8339eb60

  • SHA1

    b0c7e362c143f9c09927b53a055a9b3a53fca320

  • SHA256

    c8b6d9a3cfbd73dd39b8ec843de7f6de4972ea8e487072e07136351fad731ba4

  • SHA512

    3a29479e017b59c5d8e90665c76fbea39dd0ca0ea3e4bbcaac38d61019a3e00a956f84f70a81c19d51af6f572e419fa8d615588c606c4bf80dc4992c914a7c19

  • SSDEEP

    1536:fPWV5jS4vZv0kH9gDDtWzYCnJPeoYrGQty6i9/UP1A3:fPWV5jS4l0Y9MDYrm7q9/UM

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      c8b6d9a3cfbd73dd39b8ec843de7f6de4972ea8e487072e07136351fad731ba4N

    • Size

      78KB

    • MD5

      9a201d92f825795b6af400ba8339eb60

    • SHA1

      b0c7e362c143f9c09927b53a055a9b3a53fca320

    • SHA256

      c8b6d9a3cfbd73dd39b8ec843de7f6de4972ea8e487072e07136351fad731ba4

    • SHA512

      3a29479e017b59c5d8e90665c76fbea39dd0ca0ea3e4bbcaac38d61019a3e00a956f84f70a81c19d51af6f572e419fa8d615588c606c4bf80dc4992c914a7c19

    • SSDEEP

      1536:fPWV5jS4vZv0kH9gDDtWzYCnJPeoYrGQty6i9/UP1A3:fPWV5jS4l0Y9MDYrm7q9/UM

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks