General
-
Target
7f7e1c02807a2ac57f765a80b3ae2dde.exe
-
Size
451KB
-
Sample
240428-sb53fsac96
-
MD5
7f7e1c02807a2ac57f765a80b3ae2dde
-
SHA1
07139ac51e6664319c8f3490796f8def8ae34660
-
SHA256
84aabb05fa24bb4994957177e3721ed6666aadd821b63360ac4417009dfb7db9
-
SHA512
c3ccfb2852bfba2c3f2cf53336a42d18ed96096ed2aabbd1084e8fd48e447303b30a3109199e784afab8e1fd9cdc8e327a653664c6897c863c37dbde1ba46eaf
-
SSDEEP
6144:NeMRwnTgfMmxqWWKFj/T/WpiCWy6P/cWRk2HdZdqte0w+fFaOs2jyjaUL:NzRwnEfMmxqDOj/DBJcHM7ZKtm+gaUL
Static task
static1
Behavioral task
behavioral1
Sample
7f7e1c02807a2ac57f765a80b3ae2dde.exe
Resource
win7-20240419-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
7f7e1c02807a2ac57f765a80b3ae2dde.exe
-
Size
451KB
-
MD5
7f7e1c02807a2ac57f765a80b3ae2dde
-
SHA1
07139ac51e6664319c8f3490796f8def8ae34660
-
SHA256
84aabb05fa24bb4994957177e3721ed6666aadd821b63360ac4417009dfb7db9
-
SHA512
c3ccfb2852bfba2c3f2cf53336a42d18ed96096ed2aabbd1084e8fd48e447303b30a3109199e784afab8e1fd9cdc8e327a653664c6897c863c37dbde1ba46eaf
-
SSDEEP
6144:NeMRwnTgfMmxqWWKFj/T/WpiCWy6P/cWRk2HdZdqte0w+fFaOs2jyjaUL:NzRwnEfMmxqDOj/DBJcHM7ZKtm+gaUL
-
Detect ZGRat V1
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-