Overview

overview

10

Static

static

3

dab05827c1...cN.exe

windows7-x64

10

dab05827c1...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe

  • Size

    78KB

  • Sample

    241204-cntxys1rgk

  • MD5

    3584d349a83e79620e77fbb65ac995e0

  • SHA1

    066e6a2d4e7cf22c557fa0a7544cd958e7da69a2

  • SHA256

    dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbc

  • SHA512

    cb483d653e7d809e5123d4f4cdcdc66534d788ee390877bc6a7b3b7388d9b74be6e15b25997c93c3d602a8181bb39fd668e73ba0cf5103bce8bcaa7fa9c5479d

  • SSDEEP

    1536:We5hXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6g9/F1hn:We5hSyRxvY3md+dWWZyP9/J

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe

    • Size

      78KB

    • MD5

      3584d349a83e79620e77fbb65ac995e0

    • SHA1

      066e6a2d4e7cf22c557fa0a7544cd958e7da69a2

    • SHA256

      dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbc

    • SHA512

      cb483d653e7d809e5123d4f4cdcdc66534d788ee390877bc6a7b3b7388d9b74be6e15b25997c93c3d602a8181bb39fd668e73ba0cf5103bce8bcaa7fa9c5479d

    • SSDEEP

      1536:We5hXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6g9/F1hn:We5hSyRxvY3md+dWWZyP9/J

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks