Overview

overview

10

Static

static

3

9dadfe0f5a...9a.exe

windows7-x64

10

9dadfe0f5a...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dadfe0f5ab4242d2df27548aafb9f450824a933a40f34a8c1f94e02b7c26e9a

  • Size

    78KB

  • Sample

    241029-dqfc1stelb

  • MD5

    4a5397199affc4aa93e1340602f7a381

  • SHA1

    001cd5f2c380e7722c997bdb907608c88309e0fd

  • SHA256

    9dadfe0f5ab4242d2df27548aafb9f450824a933a40f34a8c1f94e02b7c26e9a

  • SHA512

    e161bdc33d07fc311448a9932b990fb8370a42be387f657624a05d29cb27e7aba2c08f29cdd00a9ebd312262b593e276ab55327021884dd0e94bc451d7452970

  • SSDEEP

    1536:EWtHFo6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQteE9/NF31HG:EWtHFon3xSyRxvY3md+dWWZyeE9/NFU

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      9dadfe0f5ab4242d2df27548aafb9f450824a933a40f34a8c1f94e02b7c26e9a

    • Size

      78KB

    • MD5

      4a5397199affc4aa93e1340602f7a381

    • SHA1

      001cd5f2c380e7722c997bdb907608c88309e0fd

    • SHA256

      9dadfe0f5ab4242d2df27548aafb9f450824a933a40f34a8c1f94e02b7c26e9a

    • SHA512

      e161bdc33d07fc311448a9932b990fb8370a42be387f657624a05d29cb27e7aba2c08f29cdd00a9ebd312262b593e276ab55327021884dd0e94bc451d7452970

    • SSDEEP

      1536:EWtHFo6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQteE9/NF31HG:EWtHFon3xSyRxvY3md+dWWZyeE9/NFU

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks