Overview

overview

10

Static

static

3

c1bc78e010...b4.exe

windows7-x64

10

c1bc78e010...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1bc78e0106917bb6d326e6a3ed94310e865135b75185c709f8286381de33db4.exe

  • Size

    78KB

  • Sample

    250201-wnz9hswkfl

  • MD5

    ea191a74e1c2bbcf50687d16fb91cc12

  • SHA1

    cfcb47bdd113a323289c94ea83fca8e1171a653e

  • SHA256

    c1bc78e0106917bb6d326e6a3ed94310e865135b75185c709f8286381de33db4

  • SHA512

    690fcd546fc3673b51f068a58d78f4c25dc278c9a2f0278ff4944430fa8083b859f1e70e6c28e4d16ddbaff1870b0a707086268c561cb466a620b406f3a577a6

  • SSDEEP

    1536:OPy5jqXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty699//+1xxb:OPy5jSSyRxvhTzXPvCbW2UV9//0b

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      c1bc78e0106917bb6d326e6a3ed94310e865135b75185c709f8286381de33db4.exe

    • Size

      78KB

    • MD5

      ea191a74e1c2bbcf50687d16fb91cc12

    • SHA1

      cfcb47bdd113a323289c94ea83fca8e1171a653e

    • SHA256

      c1bc78e0106917bb6d326e6a3ed94310e865135b75185c709f8286381de33db4

    • SHA512

      690fcd546fc3673b51f068a58d78f4c25dc278c9a2f0278ff4944430fa8083b859f1e70e6c28e4d16ddbaff1870b0a707086268c561cb466a620b406f3a577a6

    • SSDEEP

      1536:OPy5jqXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty699//+1xxb:OPy5jSSyRxvhTzXPvCbW2UV9//0b

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks