Overview

overview

10

Static

static

3

3fde3cfaa1...d9.exe

windows7-x64

10

3fde3cfaa1...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fde3cfaa1fbe970af9cf7da25592d6b374ee2f43115affe92cad7671803e5d9

  • Size

    78KB

  • Sample

    241028-15r2pawnew

  • MD5

    7a684b58570dc88c05eeb426a4ab5d62

  • SHA1

    026461f26749f87b7f8a66983d273b55f6126f16

  • SHA256

    3fde3cfaa1fbe970af9cf7da25592d6b374ee2f43115affe92cad7671803e5d9

  • SHA512

    761d737a389a4d7e1f5ba266bc8d870da9835107bdf17ce3b84796119324f9cb9504d42ef2d3b46640bbac4d77d6e28e1ba76df1be5e02527cc08375061c59b1

  • SSDEEP

    1536:5CHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte6b9/31bH:5CHa3Ln7N041Qqhge6b9/h

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      3fde3cfaa1fbe970af9cf7da25592d6b374ee2f43115affe92cad7671803e5d9

    • Size

      78KB

    • MD5

      7a684b58570dc88c05eeb426a4ab5d62

    • SHA1

      026461f26749f87b7f8a66983d273b55f6126f16

    • SHA256

      3fde3cfaa1fbe970af9cf7da25592d6b374ee2f43115affe92cad7671803e5d9

    • SHA512

      761d737a389a4d7e1f5ba266bc8d870da9835107bdf17ce3b84796119324f9cb9504d42ef2d3b46640bbac4d77d6e28e1ba76df1be5e02527cc08375061c59b1

    • SSDEEP

      1536:5CHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte6b9/31bH:5CHa3Ln7N041Qqhge6b9/h

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks