Overview

overview

10

Static

static

3

8512f6411b...e2.exe

windows7-x64

10

8512f6411b...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8512f6411b7c8bc5b320059b78484b1603b5ecb31f5405824815b6ffb47e57e2

  • Size

    78KB

  • Sample

    250128-avd4za1kbw

  • MD5

    12d6e4ff4033556686cdccaf7af4478f

  • SHA1

    c2f3f06052a6389f9ff79797e2b6d19d42c27cb9

  • SHA256

    8512f6411b7c8bc5b320059b78484b1603b5ecb31f5405824815b6ffb47e57e2

  • SHA512

    97c39fbd3fecef75050dbfe517a902a4e329e2cd0190924b73a1634847e50de7ae1af88af7e34624dbf9b1ff6d8b0a66eee401583517e003542ec42197e34593

  • SSDEEP

    1536:mPWV5jAXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6i9/Bj1nZ:mPWV5j4SyRxvY3md+dWWZyh9/9

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      8512f6411b7c8bc5b320059b78484b1603b5ecb31f5405824815b6ffb47e57e2

    • Size

      78KB

    • MD5

      12d6e4ff4033556686cdccaf7af4478f

    • SHA1

      c2f3f06052a6389f9ff79797e2b6d19d42c27cb9

    • SHA256

      8512f6411b7c8bc5b320059b78484b1603b5ecb31f5405824815b6ffb47e57e2

    • SHA512

      97c39fbd3fecef75050dbfe517a902a4e329e2cd0190924b73a1634847e50de7ae1af88af7e34624dbf9b1ff6d8b0a66eee401583517e003542ec42197e34593

    • SSDEEP

      1536:mPWV5jAXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6i9/Bj1nZ:mPWV5j4SyRxvY3md+dWWZyh9/9

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks