metamorpherrat | 94a59b9c7c21f10dabd2037921a755d8d60acc33415863ecbc9e64c5eaa2b52b | Triage

Sharing

General

Target

94a59b9c7c21f10dabd2037921a755d8d60acc33415863ecbc9e64c5eaa2b52bN
Size

78KB
Sample

241109-dhyvdswdkf
MD5

0e3e82661b76faee66a115a0401d5c70
SHA1

d6b65617cbfb1c17b9a9989317ad6eb4a02e9b6c
SHA256

94a59b9c7c21f10dabd2037921a755d8d60acc33415863ecbc9e64c5eaa2b52b
SHA512

a766664d546ccf3debba635d7581bb5dd611bf669a93aaa0c4f5a5eb8894ed3baeafbbf808539616bf67a797ec51c9f252d4d493a421fe397dfe0da1794db145
SSDEEP

1536:L58XLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtS6k9/u+1AY:L587E2EwR4uY41HyvYs9/um

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Targets

- Target
  
  94a59b9c7c21f10dabd2037921a755d8d60acc33415863ecbc9e64c5eaa2b52bN
- Size
  
  78KB
- MD5
  
  0e3e82661b76faee66a115a0401d5c70
- SHA1
  
  d6b65617cbfb1c17b9a9989317ad6eb4a02e9b6c
- SHA256
  
  94a59b9c7c21f10dabd2037921a755d8d60acc33415863ecbc9e64c5eaa2b52b
- SHA512
  
  a766664d546ccf3debba635d7581bb5dd611bf669a93aaa0c4f5a5eb8894ed3baeafbbf808539616bf67a797ec51c9f252d4d493a421fe397dfe0da1794db145
- SSDEEP
  
  1536:L58XLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtS6k9/u+1AY:L587E2EwR4uY41HyvYs9/um
Score

10^/10

metamorpherrat discovery persistence rat stealer trojan
- MetamorpherRAT
  Metamorpherrat is a hacking tool that has been around for a while since 2013.
  trojan rat stealer metamorpherrat
- Metamorpherrat family
  metamorpherrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metamorpherratdiscoverypersistenceratstealertrojan

behavioral2

discoverypersistence