Overview

overview

10

Static

static

3

046329b226...1N.exe

windows7-x64

10

046329b226...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    046329b226ee881748a4172c275e531618f9397f4748bb4a18e2f13d4224e831N

  • Size

    78KB

  • Sample

    241009-dg8m7sxfrk

  • MD5

    c1c088343ee0fa26e039c9990f1a2d20

  • SHA1

    274e70ffb38cffffb1a02e04b5b87124600eb139

  • SHA256

    046329b226ee881748a4172c275e531618f9397f4748bb4a18e2f13d4224e831

  • SHA512

    207037ed07645b5346a8c7e4d49cf1274ad8ba333e048a92906917694a776a63202444e909873ee2efcd7357b126879ef0b34b6523087e1f94dd130e1063a2eb

  • SSDEEP

    1536:cPWtHY6M7t/vZv0kH9gDDtWzYCnJPeoYrGQtD9/I1vl:cPWtHYnh/l0Y9MDYrm7D9/o

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      046329b226ee881748a4172c275e531618f9397f4748bb4a18e2f13d4224e831N

    • Size

      78KB

    • MD5

      c1c088343ee0fa26e039c9990f1a2d20

    • SHA1

      274e70ffb38cffffb1a02e04b5b87124600eb139

    • SHA256

      046329b226ee881748a4172c275e531618f9397f4748bb4a18e2f13d4224e831

    • SHA512

      207037ed07645b5346a8c7e4d49cf1274ad8ba333e048a92906917694a776a63202444e909873ee2efcd7357b126879ef0b34b6523087e1f94dd130e1063a2eb

    • SSDEEP

      1536:cPWtHY6M7t/vZv0kH9gDDtWzYCnJPeoYrGQtD9/I1vl:cPWtHYnh/l0Y9MDYrm7D9/o

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks