General
-
Target
ZWSTt.exe
-
Size
1.1MB
-
Sample
200707-w1c6r1xs7x
-
MD5
20e64b93aca0efbe72c29ecb1bf0b83f
-
SHA1
6d30fd63bfe8df6f57e7de64084bc4dc76be4126
-
SHA256
1630f3fabf80e99d1990176b5736835496bdbd74610d1e43eefd7088e2529a6e
-
SHA512
046ace67eee709a9e260ee55d2509e99dca2aac41effc660df0cf3c93a38e09f47aad71f22a3acc2a2defcc06acbc5c266441b263e0c1507803ec0ef08069c5b
Static task
static1
Behavioral task
behavioral1
Sample
ZWSTt.exe
Resource
win7
Behavioral task
behavioral2
Sample
ZWSTt.exe
Resource
win10v200430
Malware Config
Targets
-
-
Target
ZWSTt.exe
-
Size
1.1MB
-
MD5
20e64b93aca0efbe72c29ecb1bf0b83f
-
SHA1
6d30fd63bfe8df6f57e7de64084bc4dc76be4126
-
SHA256
1630f3fabf80e99d1990176b5736835496bdbd74610d1e43eefd7088e2529a6e
-
SHA512
046ace67eee709a9e260ee55d2509e99dca2aac41effc660df0cf3c93a38e09f47aad71f22a3acc2a2defcc06acbc5c266441b263e0c1507803ec0ef08069c5b
Score8/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Checks for installed software on the system
-
Suspicious use of SetThreadContext
-