Overview

overview

10

Static

static

3

d8bb242b66...b5.exe

windows7-x64

10

d8bb242b66...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8bb242b667097169c2e9538185ce6b0a4c9af43a3837118e6f45d17296ec5b5

  • Size

    78KB

  • Sample

    241102-tf1tzayjes

  • MD5

    aa278ddc64eabce4672cf632f31cd4ff

  • SHA1

    a30fd5c29fc9eaa4cddac9acc0f25dfb75179dd0

  • SHA256

    d8bb242b667097169c2e9538185ce6b0a4c9af43a3837118e6f45d17296ec5b5

  • SHA512

    e586bebcc77ebe0672358955121dfaba0b68264c07fac0db3b224d283c8fa4ebe67b20f7c17e57eaf229c73fd8b6eec2d6f959c11245e672291f316f36df3f48

  • SSDEEP

    1536:dRy58RXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6i9/L1X7:dRy58RSyRxvY3md+dWWZyK9/t

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      d8bb242b667097169c2e9538185ce6b0a4c9af43a3837118e6f45d17296ec5b5

    • Size

      78KB

    • MD5

      aa278ddc64eabce4672cf632f31cd4ff

    • SHA1

      a30fd5c29fc9eaa4cddac9acc0f25dfb75179dd0

    • SHA256

      d8bb242b667097169c2e9538185ce6b0a4c9af43a3837118e6f45d17296ec5b5

    • SHA512

      e586bebcc77ebe0672358955121dfaba0b68264c07fac0db3b224d283c8fa4ebe67b20f7c17e57eaf229c73fd8b6eec2d6f959c11245e672291f316f36df3f48

    • SSDEEP

      1536:dRy58RXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6i9/L1X7:dRy58RSyRxvY3md+dWWZyK9/t

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks