Overview

overview

10

Static

static

3

76e04a609b...bN.exe

windows7-x64

10

76e04a609b...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76e04a609b4e864573e24ab9ec846f6cf57318af83a986aa2c4c1415e21199abN.exe

  • Size

    78KB

  • Sample

    250116-fedfdstngl

  • MD5

    61010335d8e998d2ac1492920b3e2090

  • SHA1

    e485e13772b6dae5cc46a8aefa3082aff9778d6e

  • SHA256

    76e04a609b4e864573e24ab9ec846f6cf57318af83a986aa2c4c1415e21199ab

  • SHA512

    1f55ae2648502273faef5966341134ffdfdb3ff4b76b8d123c34f582388f4f09635fc9e3ea251ba5f881f4f1f0f74cd5977669ba239334e8114a82aa5d34b91c

  • SSDEEP

    1536:WOc58rvZv0kH9gDDtWzYCnJPeoYrGQtC6T9/Xq1c8:Fc58rl0Y9MDYrm7b9/G

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      76e04a609b4e864573e24ab9ec846f6cf57318af83a986aa2c4c1415e21199abN.exe

    • Size

      78KB

    • MD5

      61010335d8e998d2ac1492920b3e2090

    • SHA1

      e485e13772b6dae5cc46a8aefa3082aff9778d6e

    • SHA256

      76e04a609b4e864573e24ab9ec846f6cf57318af83a986aa2c4c1415e21199ab

    • SHA512

      1f55ae2648502273faef5966341134ffdfdb3ff4b76b8d123c34f582388f4f09635fc9e3ea251ba5f881f4f1f0f74cd5977669ba239334e8114a82aa5d34b91c

    • SSDEEP

      1536:WOc58rvZv0kH9gDDtWzYCnJPeoYrGQtC6T9/Xq1c8:Fc58rl0Y9MDYrm7b9/G

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks