Overview

overview

10

Static

static

3

ca2a2808f1...f9.exe

windows7-x64

10

ca2a2808f1...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca2a2808f14bf50121a00a170bae9b116bf5045fd6cacbabd14bf19ad76300f9

  • Size

    78KB

  • Sample

    241109-d8zjlswlet

  • MD5

    8ce544127397a14a6cff1ed9aaa6703d

  • SHA1

    38f76f9479539cee9889e9b32dae46d2a449e74c

  • SHA256

    ca2a2808f14bf50121a00a170bae9b116bf5045fd6cacbabd14bf19ad76300f9

  • SHA512

    52da90d86265332a8fdec0646b3f17932b9beb33954cfd5451509c6c309d8650cd8676fea3f9e22f327d24802358547763ad2ea5d9df259df88246e1cbbd2a0d

  • SSDEEP

    1536:+Py5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6n9/L1Q0:+Py5jS/SyRxvhTzXPvCbW2UP9/b

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      ca2a2808f14bf50121a00a170bae9b116bf5045fd6cacbabd14bf19ad76300f9

    • Size

      78KB

    • MD5

      8ce544127397a14a6cff1ed9aaa6703d

    • SHA1

      38f76f9479539cee9889e9b32dae46d2a449e74c

    • SHA256

      ca2a2808f14bf50121a00a170bae9b116bf5045fd6cacbabd14bf19ad76300f9

    • SHA512

      52da90d86265332a8fdec0646b3f17932b9beb33954cfd5451509c6c309d8650cd8676fea3f9e22f327d24802358547763ad2ea5d9df259df88246e1cbbd2a0d

    • SSDEEP

      1536:+Py5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6n9/L1Q0:+Py5jS/SyRxvhTzXPvCbW2UP9/b

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks