Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
30-09-2022 19:08
General
-
Target
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe
-
Size
170KB
-
MD5
ffbe42e28872589bf30ee47453cf7317
-
SHA1
a635d9935407edc15fb3c8009a9b0c79eac30349
-
SHA256
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407
-
SHA512
1ee2b2613c9ac09ac14f2baeadd726b365d6e3dd678102f3c37057ccd0aadba52417e1a95f2ad1adf5dd15cc613ddfe84b4b2a61fca24113fe96d053bfa9094a
-
SSDEEP
3072:8t65yT29uuZxb6jJqLK/B39FCITOYfc/PmDfMZUzZciGabJ:8+79umbFO/FCITOYfc/PmDfMZUzZciGw
Score
10/10
Malware Config
Signatures
-
Zingo stealer
Zingo is an info stealer first seen in March 2022.
-
Zingo stealer payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe"C:\Users\Admin\AppData\Local\Temp\241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
24KB
-
Filesize
8KB