Overview

overview

10

Static

static

3

f29362b80f...3N.exe

windows7-x64

7

f29362b80f...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f29362b80f3718cb8ed2f91da9abe1485f72cf92b0da328e99ccfa3f4a613753N.exe

  • Size

    78KB

  • Sample

    241130-rtq6kszrck

  • MD5

    e55af3ec5a0c6ef23e025e6fbc913c60

  • SHA1

    a2cce3af7848c2f8b6934f5f438a82246476628b

  • SHA256

    f29362b80f3718cb8ed2f91da9abe1485f72cf92b0da328e99ccfa3f4a613753

  • SHA512

    58f15db702173f77775d9499256994d5fbfa5d0fc1dc7c0285bbfe39b014b70c0a3346e02c9739f3dd09432791e7e31576e973d89662e439d955580d660b016e

  • SSDEEP

    1536:ze5YXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6+9/D+1dz:ze5gSyRxvhTzXPvCbW2Um9/2

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      f29362b80f3718cb8ed2f91da9abe1485f72cf92b0da328e99ccfa3f4a613753N.exe

    • Size

      78KB

    • MD5

      e55af3ec5a0c6ef23e025e6fbc913c60

    • SHA1

      a2cce3af7848c2f8b6934f5f438a82246476628b

    • SHA256

      f29362b80f3718cb8ed2f91da9abe1485f72cf92b0da328e99ccfa3f4a613753

    • SHA512

      58f15db702173f77775d9499256994d5fbfa5d0fc1dc7c0285bbfe39b014b70c0a3346e02c9739f3dd09432791e7e31576e973d89662e439d955580d660b016e

    • SSDEEP

      1536:ze5YXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6+9/D+1dz:ze5gSyRxvhTzXPvCbW2Um9/2

    Score
    10/10
    discoverypersistencemetamorpherratratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks