metamorpherrat | b852656fc617777c2f947d09669de7612deccd1dd416a9e30840f7c0fd135bf0 | Triage

Sharing

General

Target

b852656fc617777c2f947d09669de7612deccd1dd416a9e30840f7c0fd135bf0
Size

78KB
Sample

250205-d2sgqayncr
MD5

b6b118ffda8341066fd5ba634a822777
SHA1

f6fc611f438f43081ed8cd0eb4ccf0936497227e
SHA256

b852656fc617777c2f947d09669de7612deccd1dd416a9e30840f7c0fd135bf0
SHA512

8b6d48f81cc1011b52b8c9c4cfea16883143651e09e4725111d8fb92c78536b328c78ad57c2a987b20c42978ac55fefd01dc391cd550236c32164dae67a0cfca
SSDEEP

1536:4V5jSSXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6b9/Gy1hd:4V5jSKSyRxvhTzXPvCbW2UT9/9

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Targets

- Target
  
  b852656fc617777c2f947d09669de7612deccd1dd416a9e30840f7c0fd135bf0
- Size
  
  78KB
- MD5
  
  b6b118ffda8341066fd5ba634a822777
- SHA1
  
  f6fc611f438f43081ed8cd0eb4ccf0936497227e
- SHA256
  
  b852656fc617777c2f947d09669de7612deccd1dd416a9e30840f7c0fd135bf0
- SHA512
  
  8b6d48f81cc1011b52b8c9c4cfea16883143651e09e4725111d8fb92c78536b328c78ad57c2a987b20c42978ac55fefd01dc391cd550236c32164dae67a0cfca
- SSDEEP
  
  1536:4V5jSSXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6b9/Gy1hd:4V5jSKSyRxvhTzXPvCbW2UT9/9
Score

10^/10

metamorpherrat discovery persistence rat stealer trojan
- MetamorpherRAT
  Metamorpherrat is a hacking tool that has been around for a while since 2013.
  trojan rat stealer metamorpherrat
- Metamorpherrat family
  metamorpherrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metamorpherratdiscoverypersistenceratstealertrojan

behavioral2

metamorpherratdiscoverypersistenceratstealertrojan