Overview

overview

10

Static

static

3

c766907e1a...15.exe

windows7-x64

10

c766907e1a...15.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c766907e1aa7f5b0a5d05663c8886a5581d8e5934e745eee53b24dcdc300f415

  • Size

    78KB

  • Sample

    241103-erd21stpfz

  • MD5

    c926938fb669ee9810423b42306c6bbc

  • SHA1

    8cbd0e7215ae6b87f85502698f158f5528640918

  • SHA256

    c766907e1aa7f5b0a5d05663c8886a5581d8e5934e745eee53b24dcdc300f415

  • SHA512

    d1d542cfdea974ea0ed61b10bc54282554511d3ec039ee31682c48d6721925079eece72b5f2aa51bd4a34225e4c79b34ca203cc4b50d2d2745b8bcbe169ac270

  • SSDEEP

    1536:pPWtHF3M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtc9/J1aS:pPWtHF83xSyRxvY3md+dWWZyc9/J

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      c766907e1aa7f5b0a5d05663c8886a5581d8e5934e745eee53b24dcdc300f415

    • Size

      78KB

    • MD5

      c926938fb669ee9810423b42306c6bbc

    • SHA1

      8cbd0e7215ae6b87f85502698f158f5528640918

    • SHA256

      c766907e1aa7f5b0a5d05663c8886a5581d8e5934e745eee53b24dcdc300f415

    • SHA512

      d1d542cfdea974ea0ed61b10bc54282554511d3ec039ee31682c48d6721925079eece72b5f2aa51bd4a34225e4c79b34ca203cc4b50d2d2745b8bcbe169ac270

    • SSDEEP

      1536:pPWtHF3M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtc9/J1aS:pPWtHF83xSyRxvY3md+dWWZyc9/J

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks