Overview

overview

10

Static

static

3

4b2e1060cf...53.exe

windows7-x64

10

4b2e1060cf...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b2e1060cff24415c0960351de6e6dbecb397378d6eeabedfebc182dc0bb5f53

  • Size

    78KB

  • Sample

    241025-1djw1asphx

  • MD5

    132924522d6f601fdd5c7b3a68108e1f

  • SHA1

    fcde9697427c4adaefbacf41c376d19e1a1cc38c

  • SHA256

    4b2e1060cff24415c0960351de6e6dbecb397378d6eeabedfebc182dc0bb5f53

  • SHA512

    0cdeeb277a1d2e8761c096a6d7cffe6dcb8461299d9099a72fe42269478d5e84458e0f6cf03544b6fa9fa8f4f6054e9536d0b5bd314e58a268ffd351e5927de1

  • SSDEEP

    1536:K95jShvZv0kH9gDDtWzYCnJPeoYrGQtC6A9/f1T4:w5jShl0Y9MDYrm7I9/K

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      4b2e1060cff24415c0960351de6e6dbecb397378d6eeabedfebc182dc0bb5f53

    • Size

      78KB

    • MD5

      132924522d6f601fdd5c7b3a68108e1f

    • SHA1

      fcde9697427c4adaefbacf41c376d19e1a1cc38c

    • SHA256

      4b2e1060cff24415c0960351de6e6dbecb397378d6eeabedfebc182dc0bb5f53

    • SHA512

      0cdeeb277a1d2e8761c096a6d7cffe6dcb8461299d9099a72fe42269478d5e84458e0f6cf03544b6fa9fa8f4f6054e9536d0b5bd314e58a268ffd351e5927de1

    • SSDEEP

      1536:K95jShvZv0kH9gDDtWzYCnJPeoYrGQtC6A9/f1T4:w5jShl0Y9MDYrm7I9/K

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks