Overview

overview

10

Static

static

3

76c869916d...18.exe

windows7-x64

10

76c869916d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76c869916d576be8d79cc8f3e189889c_JaffaCakes118

  • Size

    78KB

  • Sample

    241028-a15twaxaql

  • MD5

    76c869916d576be8d79cc8f3e189889c

  • SHA1

    d4f03bd6d56045c45d4c29f21d78c9c52ac9b515

  • SHA256

    932996b9f2e21e80a396b4b6b0f1fc96bfdc0a97aabc15756d96e156a28302e6

  • SHA512

    0bc2f606e1ad2d24cb09868017f3af6896cb7737bbb98b57e12f568addd05c939b79ee44e6043144c836a9fba9d1c3295a62f72b2f02603667df6368de08e4d7

  • SSDEEP

    1536:7Py58Vdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6F9/CL1D1:7Py58An7N041QqhgN9/K

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      76c869916d576be8d79cc8f3e189889c_JaffaCakes118

    • Size

      78KB

    • MD5

      76c869916d576be8d79cc8f3e189889c

    • SHA1

      d4f03bd6d56045c45d4c29f21d78c9c52ac9b515

    • SHA256

      932996b9f2e21e80a396b4b6b0f1fc96bfdc0a97aabc15756d96e156a28302e6

    • SHA512

      0bc2f606e1ad2d24cb09868017f3af6896cb7737bbb98b57e12f568addd05c939b79ee44e6043144c836a9fba9d1c3295a62f72b2f02603667df6368de08e4d7

    • SSDEEP

      1536:7Py58Vdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6F9/CL1D1:7Py58An7N041QqhgN9/K

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks