Overview

overview

10

Static

static

3

deddb4c05d...18.exe

windows7-x64

10

deddb4c05d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deddb4c05d21ebfe287148692017b375_JaffaCakes118

  • Size

    78KB

  • Sample

    241210-2zmepaymdj

  • MD5

    deddb4c05d21ebfe287148692017b375

  • SHA1

    fc5e251b39d49f7d93b024dac1cac07113b17ec9

  • SHA256

    1a9ee379fa99ac78be460d500492e050d21965cd8f0575c4fb2fd2830278633c

  • SHA512

    28645e2dd19be55f86153d31c0942f29b55ff6d8e6c972fab1f67caf9832bb095689f0c79fb6e6efb0192b7206f9dccc9e85bb10e38891ea5ec227b3a7a5b65c

  • SSDEEP

    1536:15jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96T9/+s12D:15jS/SyRxvhTzXPvCbW2Uo9/a

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      deddb4c05d21ebfe287148692017b375_JaffaCakes118

    • Size

      78KB

    • MD5

      deddb4c05d21ebfe287148692017b375

    • SHA1

      fc5e251b39d49f7d93b024dac1cac07113b17ec9

    • SHA256

      1a9ee379fa99ac78be460d500492e050d21965cd8f0575c4fb2fd2830278633c

    • SHA512

      28645e2dd19be55f86153d31c0942f29b55ff6d8e6c972fab1f67caf9832bb095689f0c79fb6e6efb0192b7206f9dccc9e85bb10e38891ea5ec227b3a7a5b65c

    • SSDEEP

      1536:15jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96T9/+s12D:15jS/SyRxvhTzXPvCbW2Uo9/a

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks