Overview

overview

10

Static

static

3

b85e91b3a4...33.exe

windows7-x64

10

b85e91b3a4...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b85e91b3a492835c273e25895c8c48c47bc24f1dba9b1411e2594399c7cf4b33.exe

  • Size

    78KB

  • Sample

    241113-sl8w4axnfk

  • MD5

    68b4be56a75b7dbe03689e1d48437556

  • SHA1

    bbdd8822dbe1a62ccbe921e4f313250a10234dbd

  • SHA256

    b85e91b3a492835c273e25895c8c48c47bc24f1dba9b1411e2594399c7cf4b33

  • SHA512

    bcd9533ee699171b63d3198771a8087c58f86561287bab4576bc57e75f7e64c3a094b563242a6fedeb2e10b73b5caf55bb4ad1b413de4c6463622d90d2141e41

  • SSDEEP

    1536:8CHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte39/n14qG:8CHYn3xSyRxvY3md+dWWZye39/FG

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      b85e91b3a492835c273e25895c8c48c47bc24f1dba9b1411e2594399c7cf4b33.exe

    • Size

      78KB

    • MD5

      68b4be56a75b7dbe03689e1d48437556

    • SHA1

      bbdd8822dbe1a62ccbe921e4f313250a10234dbd

    • SHA256

      b85e91b3a492835c273e25895c8c48c47bc24f1dba9b1411e2594399c7cf4b33

    • SHA512

      bcd9533ee699171b63d3198771a8087c58f86561287bab4576bc57e75f7e64c3a094b563242a6fedeb2e10b73b5caf55bb4ad1b413de4c6463622d90d2141e41

    • SSDEEP

      1536:8CHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte39/n14qG:8CHYn3xSyRxvY3md+dWWZye39/FG

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks