Resubmissions

06-11-2022 16:59

221106-vhpedsedgq 10

30-09-2022 19:00

220930-xnsecafdhk 10

22-09-2022 12:24

220922-pk8cdsfcal 7

General

  • Target

    52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.bin

  • Size

    184KB

  • Sample

    220922-pk8cdsfcal

  • MD5

    18ee404c378f88028bb9f62b60ce03fd

  • SHA1

    c0e7e9cb52e0d9ca9efd986f56f039dff0713c98

  • SHA256

    52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238

  • SHA512

    2343152375ea206f6cb0069e82cb913e1e9c5f62a3777c2a99d180b4489cb14c8546f1279a66a4735a013d88a12db4ce2ee0d9d5c047e8036640820f877bfdaa

  • SSDEEP

    3072:Cl93zZHgog3iyNN9ufkEJ9jAOQVF+YFXL/uHVtS9Hzy1Q/iAHMP8Enu+2:CXzZHgBiy7nE/SVF+YFXL/uHVtS9Hzyz

Malware Config

Targets

    • Target

      52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.bin

    • Size

      184KB

    • MD5

      18ee404c378f88028bb9f62b60ce03fd

    • SHA1

      c0e7e9cb52e0d9ca9efd986f56f039dff0713c98

    • SHA256

      52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238

    • SHA512

      2343152375ea206f6cb0069e82cb913e1e9c5f62a3777c2a99d180b4489cb14c8546f1279a66a4735a013d88a12db4ce2ee0d9d5c047e8036640820f877bfdaa

    • SSDEEP

      3072:Cl93zZHgog3iyNN9ufkEJ9jAOQVF+YFXL/uHVtS9Hzy1Q/iAHMP8Enu+2:CXzZHgBiy7nE/SVF+YFXL/uHVtS9Hzyz

    • Zingo stealer

      Zingo is an info stealer first seen in March 2022.

    • Zingo stealer payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Tasks