Overview

overview

10

Static

static

3

30467a898e...cb.exe

windows7-x64

10

30467a898e...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30467a898e671d1d3a27a3c16c8647ebe8de3dc43b17e4234d6ae56251190ecb.exe

  • Size

    78KB

  • Sample

    241124-vcn7faypdz

  • MD5

    93c7a8b8044657becec13b3fa7afc61b

  • SHA1

    e04d9bcdc3196b0eafdb7a056fc1a8982de47935

  • SHA256

    30467a898e671d1d3a27a3c16c8647ebe8de3dc43b17e4234d6ae56251190ecb

  • SHA512

    8fce401ad3e906f1ce0963829903316d0523b63f860df35e1921d4785f37028808012948585c4038dbab8349ccf427a69460faaf9ba46ccb98e79f62a87e6f28

  • SSDEEP

    1536:LCHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtB9/G1dJ1:LCHYn3xSyRxvY3md+dWWZyB9/U1

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      30467a898e671d1d3a27a3c16c8647ebe8de3dc43b17e4234d6ae56251190ecb.exe

    • Size

      78KB

    • MD5

      93c7a8b8044657becec13b3fa7afc61b

    • SHA1

      e04d9bcdc3196b0eafdb7a056fc1a8982de47935

    • SHA256

      30467a898e671d1d3a27a3c16c8647ebe8de3dc43b17e4234d6ae56251190ecb

    • SHA512

      8fce401ad3e906f1ce0963829903316d0523b63f860df35e1921d4785f37028808012948585c4038dbab8349ccf427a69460faaf9ba46ccb98e79f62a87e6f28

    • SSDEEP

      1536:LCHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtB9/G1dJ1:LCHYn3xSyRxvY3md+dWWZyB9/U1

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks