Overview

overview

10

Static

static

3

28e1aab094...5N.exe

windows7-x64

10

28e1aab094...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28e1aab094fedfae24008315310247a1a9775e06f49b682b3bd19d0a6a037d25N

  • Size

    78KB

  • Sample

    241006-d4lryswcjb

  • MD5

    0c302be2c485ac1248ae94f54e3f5310

  • SHA1

    96405b5ed2f2d055e3f4416f99aa4209bab415fc

  • SHA256

    28e1aab094fedfae24008315310247a1a9775e06f49b682b3bd19d0a6a037d25

  • SHA512

    2bdf429f0d955cb7b1e023769bf90d202b764a8b07aae00032aefdd4ad63f38dcc4325eee08cad2fca672188afe670de15bbf1b941cc2c4ad54e5694032912a2

  • SSDEEP

    1536:hCHFo6M7t/vZv0kH9gDDtWzYCnJPeoYrGQt89/vd1t/:hCHFonh/l0Y9MDYrm789/vl

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      28e1aab094fedfae24008315310247a1a9775e06f49b682b3bd19d0a6a037d25N

    • Size

      78KB

    • MD5

      0c302be2c485ac1248ae94f54e3f5310

    • SHA1

      96405b5ed2f2d055e3f4416f99aa4209bab415fc

    • SHA256

      28e1aab094fedfae24008315310247a1a9775e06f49b682b3bd19d0a6a037d25

    • SHA512

      2bdf429f0d955cb7b1e023769bf90d202b764a8b07aae00032aefdd4ad63f38dcc4325eee08cad2fca672188afe670de15bbf1b941cc2c4ad54e5694032912a2

    • SSDEEP

      1536:hCHFo6M7t/vZv0kH9gDDtWzYCnJPeoYrGQt89/vd1t/:hCHFonh/l0Y9MDYrm789/vl

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks