Overview

overview

10

Static

static

3

2ba7192844...18.exe

windows7-x64

10

2ba7192844...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ba7192844dd8da4478b3bd0f760d544_JaffaCakes118

  • Size

    78KB

  • Sample

    241009-f34x9asgll

  • MD5

    2ba7192844dd8da4478b3bd0f760d544

  • SHA1

    a5c9605aeb46f07bd059380aa66b439950e04468

  • SHA256

    a8773b53ed36aec235ae1bd606cfa4a9ae1487cc611dd16e83e03dd10de18cc5

  • SHA512

    748c236ec0d7c4400d791f8f2f5affddfb8e1fd7953994411831a33ca760add6438e51785203a3e80d039c58b2c52ab27a5ffbe5b11b10d6d181f6157caaf515

  • SSDEEP

    1536:nVy5+Vdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQt96z59/Yv1ds:Vy5+/vqyA11XYUBxprBPjci9/b

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      2ba7192844dd8da4478b3bd0f760d544_JaffaCakes118

    • Size

      78KB

    • MD5

      2ba7192844dd8da4478b3bd0f760d544

    • SHA1

      a5c9605aeb46f07bd059380aa66b439950e04468

    • SHA256

      a8773b53ed36aec235ae1bd606cfa4a9ae1487cc611dd16e83e03dd10de18cc5

    • SHA512

      748c236ec0d7c4400d791f8f2f5affddfb8e1fd7953994411831a33ca760add6438e51785203a3e80d039c58b2c52ab27a5ffbe5b11b10d6d181f6157caaf515

    • SSDEEP

      1536:nVy5+Vdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQt96z59/Yv1ds:Vy5+/vqyA11XYUBxprBPjci9/b

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks