Overview

overview

10

Static

static

3

2523b51129...e0.exe

windows7-x64

10

2523b51129...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2523b511291f97d7805de0d8e258f069a08fc27e9adb07310f42f3d3feb58be0

  • Size

    78KB

  • Sample

    241017-x6k3zsvejn

  • MD5

    23b21119a60e8c2ff38814c1b6a5e10a

  • SHA1

    f94a1fe269170fc4d2bce2cbd4b76146853029a6

  • SHA256

    2523b511291f97d7805de0d8e258f069a08fc27e9adb07310f42f3d3feb58be0

  • SHA512

    e34141db8f24c41a4c323ef20b4a9c0b54fd678b4f31c447dcffe7e96d1934011209c032b6a6f401ab3369f7e0023f60796f38a19c34a8372211e20e41a48e72

  • SSDEEP

    1536:LhRWV58wXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt9679/k1Y9:dRWV58oSyRxvY3md+dWWZy89/t

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      2523b511291f97d7805de0d8e258f069a08fc27e9adb07310f42f3d3feb58be0

    • Size

      78KB

    • MD5

      23b21119a60e8c2ff38814c1b6a5e10a

    • SHA1

      f94a1fe269170fc4d2bce2cbd4b76146853029a6

    • SHA256

      2523b511291f97d7805de0d8e258f069a08fc27e9adb07310f42f3d3feb58be0

    • SHA512

      e34141db8f24c41a4c323ef20b4a9c0b54fd678b4f31c447dcffe7e96d1934011209c032b6a6f401ab3369f7e0023f60796f38a19c34a8372211e20e41a48e72

    • SSDEEP

      1536:LhRWV58wXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt9679/k1Y9:dRWV58oSyRxvY3md+dWWZy89/t

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks