metamorpherrat | bb69be9d8cbaf2ce72a3bc185ea5e8c4a8e4ceb5461814ca57a9ce33cd2ee950 | Triage

Sharing

General

Target

bb69be9d8cbaf2ce72a3bc185ea5e8c4a8e4ceb5461814ca57a9ce33cd2ee950N.exe
Size

78KB
Sample

250215-18ewjaxnhx
MD5

4d9704de5b101cb7cb88871e0999c910
SHA1

7b0ae9dc38e3c2318e5fd1bff3c065d9bdd4a204
SHA256

bb69be9d8cbaf2ce72a3bc185ea5e8c4a8e4ceb5461814ca57a9ce33cd2ee950
SHA512

b320f18296d7794fda9f8d0d4bb2e849e0a8d1887a70a216ef8dc0fe83151e154e3aca0228500142b46e3a9170b702e05b0396fde5e5c8c7941c9c1ab3659a4b
SSDEEP

1536:XsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtg9/q1zi:XsHY53Ln7N041Qqhgg9/t

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Targets

- Target
  
  bb69be9d8cbaf2ce72a3bc185ea5e8c4a8e4ceb5461814ca57a9ce33cd2ee950N.exe
- Size
  
  78KB
- MD5
  
  4d9704de5b101cb7cb88871e0999c910
- SHA1
  
  7b0ae9dc38e3c2318e5fd1bff3c065d9bdd4a204
- SHA256
  
  bb69be9d8cbaf2ce72a3bc185ea5e8c4a8e4ceb5461814ca57a9ce33cd2ee950
- SHA512
  
  b320f18296d7794fda9f8d0d4bb2e849e0a8d1887a70a216ef8dc0fe83151e154e3aca0228500142b46e3a9170b702e05b0396fde5e5c8c7941c9c1ab3659a4b
- SSDEEP
  
  1536:XsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtg9/q1zi:XsHY53Ln7N041Qqhgg9/t
Score

10^/10

discovery persistence metamorpherrat rat stealer trojan
- MetamorpherRAT
  Metamorpherrat is a hacking tool that has been around for a while since 2013.
  trojan rat stealer metamorpherrat
- Metamorpherrat family
  metamorpherrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

metamorpherratdiscoverypersistenceratstealertrojan