Overview

overview

10

Static

static

3

965a9ff8ae...fd.exe

windows7-x64

10

965a9ff8ae...fd.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    965a9ff8aefa5f2cd84039ad21b490d565008e3d94980636835e7e3c29835ffd.exe

  • Size

    78KB

  • Sample

    241226-xbrx2svmdq

  • MD5

    b209d0f39e8ccfe218225108100664d1

  • SHA1

    6a0896294a8d9e1442b5a7b70e1c8ef30844ff2e

  • SHA256

    965a9ff8aefa5f2cd84039ad21b490d565008e3d94980636835e7e3c29835ffd

  • SHA512

    9c52f9a7656905baf1173b59a18ab5bf9de8cf09013f2468bc99b573f24cb34eb155439be50e09d010f7286cfc3c9e58d4df781f9c146f954d2e52ca3aa3335d

  • SSDEEP

    1536:NB58eXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN6Z9/IT15VP:X58WSyRxvhTzXPvCbW2U29/mP

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      965a9ff8aefa5f2cd84039ad21b490d565008e3d94980636835e7e3c29835ffd.exe

    • Size

      78KB

    • MD5

      b209d0f39e8ccfe218225108100664d1

    • SHA1

      6a0896294a8d9e1442b5a7b70e1c8ef30844ff2e

    • SHA256

      965a9ff8aefa5f2cd84039ad21b490d565008e3d94980636835e7e3c29835ffd

    • SHA512

      9c52f9a7656905baf1173b59a18ab5bf9de8cf09013f2468bc99b573f24cb34eb155439be50e09d010f7286cfc3c9e58d4df781f9c146f954d2e52ca3aa3335d

    • SSDEEP

      1536:NB58eXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN6Z9/IT15VP:X58WSyRxvhTzXPvCbW2U29/mP

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks