Description
suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)
gayporn.exe
General
Target
Size
Sample
gayporn.exe
185KB
220513-v9zz7scgem
Score
10 /10
MD5
SHA1
SHA256
SHA512
dc73d106133d7f4652a22a2ba5838bab
1a24617b06b8c7a694ee6fef57d454ba9dad72fb
219f75d798f48a66a7643cacca827cd6d9fbf72af8dfaa05b88cb0538a7864f7
39f6cf4c0d3c27bd690846ee6893e12ef6d6e13e6b975cf65c69f786fda2baa4c17e681b9f5fc5da9a21e7a5a7214f9c4393b344828104234bbf9d1d022b8c4a
Malware Config
Targets
Target
MD5
Filesize
gayporn.exe
dc73d106133d7f4652a22a2ba5838bab
185KB
Score
10/10
SHA1
SHA256
SHA512
1a24617b06b8c7a694ee6fef57d454ba9dad72fb
219f75d798f48a66a7643cacca827cd6d9fbf72af8dfaa05b88cb0538a7864f7
39f6cf4c0d3c27bd690846ee6893e12ef6d6e13e6b975cf65c69f786fda2baa4c17e681b9f5fc5da9a21e7a5a7214f9c4393b344828104234bbf9d1d022b8c4a
Tags
Signatures
-
suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Possible privilege escalation attempt
Tags
-
Stops running service(s)
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Loads dropped DLL
-
Modifies file permissions
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks