Overview

overview

10

Static

static

3

1917fbf8ed...0N.exe

windows7-x64

10

1917fbf8ed...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1917fbf8ed759c61afd816961879b4d924bce61fd33a8cd58a511cdcc9df5230N.exe

  • Size

    78KB

  • Sample

    241231-yl4v2aynfk

  • MD5

    b84d89a0123f7489719b22e498eeef30

  • SHA1

    1c6157ea282a84f5d9712db3280186a938935251

  • SHA256

    1917fbf8ed759c61afd816961879b4d924bce61fd33a8cd58a511cdcc9df5230

  • SHA512

    6d2a78d78482f6aa0d36e92744ce7b635d1a1af854396aa4c66156618712c13262ec102ad1f442616172ef3fc795fb1c7e1fa350469332ff51799fa0c3db1521

  • SSDEEP

    1536:7zV5jS2vZv0kH9gDDtWzYCnJPeoYrGQtC6N9/M1+V:nV5jS2l0Y9MDYrm719/f

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      1917fbf8ed759c61afd816961879b4d924bce61fd33a8cd58a511cdcc9df5230N.exe

    • Size

      78KB

    • MD5

      b84d89a0123f7489719b22e498eeef30

    • SHA1

      1c6157ea282a84f5d9712db3280186a938935251

    • SHA256

      1917fbf8ed759c61afd816961879b4d924bce61fd33a8cd58a511cdcc9df5230

    • SHA512

      6d2a78d78482f6aa0d36e92744ce7b635d1a1af854396aa4c66156618712c13262ec102ad1f442616172ef3fc795fb1c7e1fa350469332ff51799fa0c3db1521

    • SSDEEP

      1536:7zV5jS2vZv0kH9gDDtWzYCnJPeoYrGQtC6N9/M1+V:nV5jS2l0Y9MDYrm719/f

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks