Overview

overview

10

Static

static

3

88bd67c1ba...7f.exe

windows7-x64

10

88bd67c1ba...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88bd67c1bade044ee3c0b26c42880b21fad1c1c5024bc35388161034a5d9287f

  • Size

    78KB

  • Sample

    250222-ed1zmayry8

  • MD5

    0dd799c9053d71978a3afcf072d4fade

  • SHA1

    a4ec52f174e57096931eeb388489af8876d2c065

  • SHA256

    88bd67c1bade044ee3c0b26c42880b21fad1c1c5024bc35388161034a5d9287f

  • SHA512

    17e3a6658faa8332ed022f6a7c033af1b6e83063e6640acd4216dbea28348a136d758e1805d9c93c4e520e8fdf52d8eec028cdb7028b30c9f35b3e39c9a6ea9c

  • SSDEEP

    1536:Ie5Rdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6H9/n1hs:Ie58n7N041Qqhgv9/w

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      88bd67c1bade044ee3c0b26c42880b21fad1c1c5024bc35388161034a5d9287f

    • Size

      78KB

    • MD5

      0dd799c9053d71978a3afcf072d4fade

    • SHA1

      a4ec52f174e57096931eeb388489af8876d2c065

    • SHA256

      88bd67c1bade044ee3c0b26c42880b21fad1c1c5024bc35388161034a5d9287f

    • SHA512

      17e3a6658faa8332ed022f6a7c033af1b6e83063e6640acd4216dbea28348a136d758e1805d9c93c4e520e8fdf52d8eec028cdb7028b30c9f35b3e39c9a6ea9c

    • SSDEEP

      1536:Ie5Rdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6H9/n1hs:Ie58n7N041Qqhgv9/w

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Metamorpherrat family

      metamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks