Overview

overview

10

Static

static

3

4bb68f2ff4...a9.exe

windows7-x64

10

4bb68f2ff4...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4bb68f2ff437fbb0704de64c7835bd41764d9cb46d788e25003b06cbab59bca9

  • Size

    78KB

  • Sample

    250110-3jy9zsvrhp

  • MD5

    178e3d77b3f0da658913a4e72e09ff67

  • SHA1

    5320116e8d9e8c4bbc4c7d54bc4de305b92b3387

  • SHA256

    4bb68f2ff437fbb0704de64c7835bd41764d9cb46d788e25003b06cbab59bca9

  • SHA512

    15a04187d6698f6929195086315a82322f17e4ef56378436f1824eafd88c3b49a7acb6bc4d826e96297fa96d0b578a49ba63cc02ca9593fc2fed47c73405e931

  • SSDEEP

    1536:Se5OXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC69q49/E1eD:Se5GSyRxvhTzXPvCbW2UFq49/l

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      4bb68f2ff437fbb0704de64c7835bd41764d9cb46d788e25003b06cbab59bca9

    • Size

      78KB

    • MD5

      178e3d77b3f0da658913a4e72e09ff67

    • SHA1

      5320116e8d9e8c4bbc4c7d54bc4de305b92b3387

    • SHA256

      4bb68f2ff437fbb0704de64c7835bd41764d9cb46d788e25003b06cbab59bca9

    • SHA512

      15a04187d6698f6929195086315a82322f17e4ef56378436f1824eafd88c3b49a7acb6bc4d826e96297fa96d0b578a49ba63cc02ca9593fc2fed47c73405e931

    • SSDEEP

      1536:Se5OXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC69q49/E1eD:Se5GSyRxvhTzXPvCbW2UFq49/l

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks